CVE-2025-70147High· 7.5▾ MidnightPoC availableMissing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET …
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.6%
Missing authentication in /admin/student.php and /admin/teacher.php in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to obtain sensitive information (including plaintext password field values) via direct HTTP GET requests to these endpoints without a valid session.
online_time_table_generator = 1.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2025-70146Critical· 9.1Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting reco…
CVE-2025-70141Critical· 9.4SourceCodester Customer Support System 1.0 contains an incorrect access control vulnerability in ajax.php
CVE-2026-114266Medium· 6.3ProjectWorlds Advanced Library Management System profile.php mysqli_query sql injection
CVE-2026-114263High· 7.3ProjectWorlds Advanced Library Management System individual_report_search.php mysqli_query sql injection
CVE-2026-114264Medium· 4.7ProjectWorlds Advanced Library Management System edit_member.php sql injection
CVE-2026-114265Medium· 6.3ProjectWorlds Advanced Library Management System Search Form returned_book_search.php mysqli_query sql injection