CVE-2016-8870

PoC —

CVSS 3.0

8.1 high

EPSS

81%p100

Published

Nov 4, 2016 (Nov 4, 2016)

Modified

Jun 17, 2026

Description

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

Vendors: joomla
Products: joomla\!
Ecosystems: Joomla
Weakness: CWE-20
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (81.2%)

In the news5 stories

Critical SQL Injection CVE-2017-8917 vulnerability patched in Joomla, update it now!

Security AffairsMay 18, 07:39 UTC · May 18, 2017Vulnerability CVE-2017-8917 CVE-2016-8870 CVE-2016-8869

CVE-2016-8870

In the news5 stories

Critical SQL Injection CVE-2017-8917 vulnerability patched in Joomla, update it now!

Massive hacking campaign on Joomla sites via recently patched flaws

Most unpatched Joomla sites compromised in latest wave of attacks

Two Critical Vulnerabilities Patched in Joomla 3.6.4. Update it asap!

Joomla Joomla! Two Critical Flaws Discovered — Update to Protect Your Site