CVE-2016-9838 is a critical vulnerability affecting Joomla! versions prior to 3.6.5, specifically within the registration component. This flaw allows an unauthenticated attacker to manipulate registration form data during a validation error, enabling them to reset a registered user's group mappings, username, and password, effectively leading to account takeover. With a CVSS score of 7.5 (High), the attack requires no user interaction and has low attack complexity, posing a significant integrity risk. While not listed on CISA's KEV, public exploit code exists (EDB-41157), and the vulnerability has garnered substantial community discussion and media coverage, indicating its potential for exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.6.4CPE matchmatch criteria | cpe:2.3:a:joomla:joomla\!:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.