CVE-2016-8869

PoC ×2—

CVSS 3.0

9.8 critical

EPSS

97%p100

Published

Nov 4, 2016 (Nov 4, 2016)

Modified

Jun 17, 2026

Description

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4 allows remote attackers to gain privileges by leveraging incorrect use of unfiltered data when registering on a site.

Vendors: joomla
Products: joomla\!
Ecosystems: Joomla
Weakness: CWE-20
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (97.2%)

In the news6 stories

Network Attack Trends: Internet of Threats (November 2020

Palo Alto Unit 42Jun 6, 13:24 UTC · Jun 6, 2024Exploit / PoC in the wildCVE-2020-28188 CVE-2020-17519 CVE-2020-29227+62 CVEs

Critical SQL Injection CVE-2017-8917 vulnerability patched in Joomla, update it now!

Security AffairsMay 18, 07:39 UTC · May 18, 2017Vulnerability CVE-2017-8917 CVE-2016-8870 CVE-2016-8869

CVE-2016-8869

In the news6 stories

Network Attack Trends: Internet of Threats (November 2020

Critical SQL Injection CVE-2017-8917 vulnerability patched in Joomla, update it now!

Massive hacking campaign on Joomla sites via recently patched flaws

Most unpatched Joomla sites compromised in latest wave of attacks

Two Critical Vulnerabilities Patched in Joomla 3.6.4. Update it asap!

Joomla Joomla! Two Critical Flaws Discovered — Update to Protect Your Site