What is the CVSS score of CVE-2025-70146?

CVE-2025-70146 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.4%.

Is there a public PoC exploit available for CVE-2025-70146?

Yes, a public proof-of-concept exploit is available for CVE-2025-70146. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2025-70146?

Within 24 hours: Isolate affected systems from production environments or disable public access to the Time Table Generator application; identify all instances running version 1.0 across your infrastructure. Within 7 days: Implement network-level access controls (IP whitelisting, VPN-only access) and deploy WAF rules to block unauthenticated requests to critical endpoints; conduct audit logs for unauthorized access attempts. Within 30 days: Evaluate alternative scheduling solutions or contact vendor for patched release timeline; plan migration strategy if patch availability remains uncertain.

Online Time Table Generator CVE-2025-70146

CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-02-18 cve@mitre.org

Authentication Bypass Online Time Table Generator Projectworlds

9.1

CVSS 3.1 · Vendor: mitre

View

Vulnerability Assessment

Weakness	CWE CWE-306 OWASP Top 10:2025 A07:2025 - Authentication Failures ASVS 5.0 V6 - Authentication Authentication required for critical functions MITRE ATT&CK 1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Impact	CVSS 9.1. Multiple unprotected admin endpoints. Educational project with weak security posture.
Exploit ScenarioDerived	Unauthenticated attacker directly accesses admin scripts to modify timetables, user accounts, or system settings.

Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.

No patch listed yet 0.4% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Missing authentication on multiple admin action scripts in ProjectWorlds Online Time Table Generator allows unauthenticated users to perform administrative operations. PoC available.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 21:55 CVSS 9.1

Missing admin authentication in ProjectWorlds Time Table Generator.

RemediationAI

Implement authentication middleware for all /admin/ endpoints.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

CWE-306 missing authentication on administrative scripts under /admin/ directory.

Know when Online Time Table Generator gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (mitre) PRIMARY 9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

PoC Detected

Feb 20, 2026 - 20:07 vuln.today

Public exploit code

CVE Published

Feb 18, 2026 - 17:21 nvd

CRITICAL 9.1

DescriptionCVE.org

Missing authentication in multiple administrative action scripts under /admin/ in ProjectWorlds Online Time Table Generator 1.0 allows remote attackers to perform unauthorized administrative operations (e.g.,adding records, deleting records) via direct HTTP requests to affected endpoints without a valid session.

Executive ViewAI

Why It Matters

A critical authentication bypass vulnerability in Online Time Table Generator v1.0 allows unauthorized users to access and manipulate sensitive scheduling functions without credentials. Organizations using this software face immediate risk of operational disruption, data tampering, and potential service unavailability, with active exploits already circulating.

Business Impact: Severe

Compensating Controls

Implement Web Application Firewall (WAF) rules to require authentication tokens on all critical endpoints; restrict network access to the application via IP whitelisting or VPN-only connectivity; disable or restrict the Time Table Generator feature until patched; place application behind reverse proxy with mandatory authentication layer; enable comprehensive logging and real-time alerting for unauthorized access attempts; consider temporary air-gapping the affected system if operationally feasible.

Threat Intelligence Overview

EPSS Score

0.4%

Top 42% exploitable

Exploit

POC

Public exploit code exists

Data Quality

3 sources

Confidence: Low

NVD

CVE.org

EPSS

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity CRITICAL

CISA KEV No

Public POC Yes

EPSS 0.4%

Patch available No

Active threat No

Deciding rule

CRITICAL severity + public POC available

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Out-of-Cycle

Exploitation· derived

Poc

System Exposure· derived

Open

Automatable· derived

Yes

Human Impact

Very High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +46

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

Affected Products (CPE)CVE.org

cpe:2.3:a:projectworlds:online_time_table_generator:1.0:*:*:*:*:*:*:*

More in Online Time Table Generator

View all

CVE-2024-0730 CRITICAL Act Now POC

9.8 Jan 19

A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. Rated cr

CVE-2025-70147 HIGH This Week POC

7.5 Feb 18

Online Time Table Generator versions up to 1.0 is affected by missing authentication for critical function (CVSS 7.5).

CVE-2025-2661 MEDIUM This Month POC

6.9 Mar 23

A vulnerability was found in Project Worlds Online Time Table Generator 1.0 and classified as critical.php. Rated medium

CVE-2025-2660 MEDIUM This Month POC

6.9 Mar 23

A vulnerability has been found in Project Worlds Online Time Table Generator 1.0 and classified as critical. Rated mediu

CVE-2025-2659 MEDIUM This Month POC

6.9 Mar 23

A vulnerability, which was classified as critical, was found in Project Worlds Online Time Table Generator 1.0. Rated me

CVE-2025-3042 MEDIUM This Month POC

5.3 Apr 01

A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Rated medium severit

CVE-2025-3041 MEDIUM This Month POC

5.3 Apr 01

A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Rated medium se

CVE-2025-3040 MEDIUM This Month POC

5.3 Mar 31

A vulnerability was found in Project Worlds Online Time Table Generator 1.0. Rated medium severity (CVSS 5.3), this vuln

CVE-2025-2662 MEDIUM This Month POC

5.3 Mar 23

A vulnerability was found in Project Worlds Online Time Table Generator 1.0. Rated medium severity (CVSS 5.3), this vuln

CVE-2024-10447 MEDIUM This Month POC

5.3 Oct 28

A vulnerability classified as critical was found in Project Worlds Online Time Table Generator 1.0. Rated medium severit

CVE-2024-10446 MEDIUM This Month POC

5.3 Oct 28

A vulnerability classified as critical has been found in Project Worlds Online Time Table Generator 1.0. Rated medium se

CVE-2025-5008 MEDIUM This Week POC

6.9 May 20

A vulnerability was found in projectworlds Online Time Table Generator 1.0. Rated medium severity (CVSS 6.9), this vulne

Same weakness CWE-306 – Missing Authentication for Critical Function

View all

CVE-2024-0012 CRITICAL POC

9.3

CVE-2017-10271 HIGH POC

7.5

CVE-2025-3248 CRITICAL POC

9.8

CVE-2024-11680 CRITICAL POC

9.8

CVE-2024-51567 CRITICAL POC

9.8

CVE-2025-0108 HIGH POC

8.8

CVE-2025-61757 CRITICAL POC

9.8

CVE-2025-32433 CRITICAL POC

10.0

Same technique Authentication Bypass

View all

CVE-2015-3306 CRITICAL POC

10.0

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

References

Advisories & patches

REF https://0x0bito.github.io/posts/CVE-2025-70146-OTTTG-Unauth-Deletion/ REF https://projectworlds.com/online-time-table-generator-php-mysql/

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back