ZeroDay Findings
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-40070

Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save.

Published Apr 16, 2025 · catalog updated Apr 16, 2025 · n/a n/a

Severity
Medium5.1
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
26.0%
Remediation
Vendor / distro source
Affected products
vendor n/a n/a n/a

Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Technical analysis

Mechanism and impact are interpreted from ingested advisories — not independent exploit research.

  • CWE classification

    No CWE identifiers stored yet.

  • Prerequisites and impact

    Follow the original vendor advisory for access prerequisites and impact. This catalog does not invent exploit conditions.

How to fix CVE-2024-40070

  • Recommended remediation

    A vendor or distribution source is linked. Check that advisory for patch availability; this catalog does not invent fix status.

  • Official advisories

What to do

Three reads of the same public record: the decision, the versions on file, and the signals. Confirm the vendor advisory before you patch. This page does not publish exploit steps.

Executive

This is a public record, not a confirmed incident. CVE-2024-40070 is a medium issue in n/a n/a (CVSS 5.1). CISA does not currently list it as known exploited. Next step: Compare installed versions with the linked vendor advisory before changing production.

System administrator

Check whether n/a n/a is installed. Ranges on record: n/a n/a n/a (n/a). Compare installed versions with the linked vendor advisory before changing production.

Security analyst

CVSS 5.1. EPSS 26.0%. CISA does not currently list it as known exploited. Weaknesses: not classified. Sources: euvd. Exploit links, when listed below, point at the original publisher.

Related intelligence

  • Exploitation evidence

    Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.

  • Safe detection guidance

    Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 16, 2025 · EUVD

    Detected

    Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

  2. Apr 16, 2025 · EUVD

    Updated

    Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

Affected versions

Enter an installed version to get a verified affected / not-affected result against the ranges below.

  • vendor n/a n/a n/an/a

Sources

  • EUVDVulnerability recordEUVD-2024-54423

    Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.

    euvd.enisa.europa.eu

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.