Description

The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.

Remediation

References

CVE-2016-8870

Related Vulnerabilities

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-43787)

CubeCart Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2025-59412)

Oracle Database Server CVE-2006-0260 Vulnerability (CVE-2006-0260)

WordPress Plugin FluentAuth-The Ultimate Authorization & Security for WordPress Security Bypass (1.0.1)

WordPress Plugin Nelio AB Testing Directory Traversal (4.4.4)

Severity

High

Classification

CVE-2016-8870 CWE-20 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities