NewA calmer, faster ZeroHour — security assessments on articles, story timelines and search from any page.

VulnerabilityPoC2 · 1 read

CVE-2016-8870

CVSS 3.0: 8.1 high
EPSS: 81%p100
Published: Nov 4, 2016 · Nov 4, 2016
Modified: Jun 17, 2026

Analyze CVE-2016-8870 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

Vendors: joomla

Products: joomla\!

Ecosystems: Joomla

Weakness: CWE-20

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (81.2%)

In the news

5 stories

Critical SQL Injection CVE-2017-8917 vulnerability patched in Joomla, update it now!

Security AffairsMay 18, 07:39 UTC · May 18, 2017VulnerabilityCVE-2017-8917 CVE-2016-8870 CVE-2016-88692

60

Massive hacking campaign on Joomla sites via recently patched flaws

Security AffairsOct 31, 08:37 UTC · Oct 31, 2016VulnerabilityExploitedCVE-2016-8870 CVE-2016-88693

60

Most unpatched Joomla sites compromised in latest wave of attacks

Help Net SecurityOct 31, 00:00 UTC · Oct 31, 2016VulnerabilityExploitedCVE-2016-8870 CVE-2016-88692 · 1 read

60

Two Critical Vulnerabilities Patched in Joomla 3.6.4. Update it asap!

Security AffairsOct 26, 06:15 UTC · Oct 26, 2016VulnerabilityCVE-2016-8870 CVE-2016-88693 · 1 read

60

Joomla Joomla! Two Critical Flaws Discovered — Update to Protect Your Site

The Hacker NewsOct 25, 14:50 UTC · Oct 25, 2016VulnerabilityCVE-2016-8870 CVE-2016-88692 · 1 read

60