Is CVE-2025-70146 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-70146 being exploited in the wild.

How severe is CVE-2025-70146?

Critical severity, with a CVSS score of 9.1, published 18 February 2026.

Which products and versions are affected?

Projectworlds Online Time Table Generator 1.0.

Is there a fix for CVE-2025-70146?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-70146 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2025-70146?

Check whether you run Projectworlds Online Time Table Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-70146: ProjectWorlds Online Time Table Generator missing authentication in admin deletion endpoints

CVE-2025-70146 · Severity: critical · CVSS 9.1 · Published 2026-02-18

ProjectWorlds Online Time Table Generator is a PHP/MySQL web application used by schools and universities to automatically create class schedules. An attacker can delete critical records—including students, teachers, courses, and timetables—by sending HTTP requests directly to unprotected administrative endpoints without logging in. This allows complete destruction of scheduling data, rendering the system unusable and causing operational disruption.

Vendors: Projectworlds.

Quick answers

Is CVE-2025-70146 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-70146 being exploited in the wild.
How severe is CVE-2025-70146?: Critical severity, with a CVSS score of 9.1, published 18 February 2026.
Which products and versions are affected?: Projectworlds Online Time Table Generator 1.0.
Is there a fix for CVE-2025-70146?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-70146 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2025-70146?: Check whether you run Projectworlds Online Time Table Generator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a broken access control flaw (CWE-306, CWE-862) in multiple administrative deletion scripts under /admin/ that lack authentication checks. Each delete endpoint (e.g., /admin/deletestudent.php, /admin/deleteteacher.php, /admin/deletesubject.php) accepts identifier parameters via HTTP GET requests and executes SQL DELETE operations directly without verifying an active admin session or authorization. An unauthenticated remote attacker can invoke these endpoints over the network with crafted parameters to delete arbitrary database records. The root cause is the complete absence of session validation; scripts only include database configuration and perform deletion without any session_start() or role-based access control checks. No patch is mentioned in the advisory, and the recommended fix is to enforce session authentication at the entry point of each delete script.

Affected products

ProjectWorlds Online Time Table Generator 1.0

Timeline

2025-12-22: disclosed: Vulnerability discovered by MinhKhoa
2026-02-18: advisory: Published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.