CVE-2016-9081

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Joomla! 3.4.4 through 3.6.3 allows attackers to reset username, password, and user group assignments and possibly perform other user account modifications via unspecified vectors.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.securityfocus.com/bid/93969Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.htmlPatch, Vendor Advisory
http://www.securityfocus.com/bid/93969Third Party Advisory, VDB Entry
https://developer.joomla.org/security-centre/661-20161003-core-account-modifications.htmlPatch, Vendor Advisory

Timeline

Published: Jan 23, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-90825.5Integer overflow in the write_png function in cairo 1.14.6 allows remote attackers to cause a denial of service (invalid pointer dereference CVE-2016-90837.8drivers/vfio/pci/vfio_pci.c in the Linux kernel through 4.8.11 allows local users to bypass integer overflow checks, and cause a denial of s CVE-2016-90847.8drivers/vfio/pci/vfio_pci_intrs.c in the Linux kernel through 4.8.11 misuses the kzalloc function, which allows local users to cause a denia CVE-2016-90853.3Multiple integer overflows in libwebp allows attackers to have unspecified impact via unknown vectors.CVE-2016-90866.5GitLab versions 8.9.x and above contain a critical security flaw in the "import/export project" feature of GitLab. Added in GitLab 8.9, this CVE-2016-90879.8SQL injection vulnerability in framework/modules/filedownloads/controllers/filedownloadController.php in Exponent CMS 2.3.9 and earlier allo CVE-2016-90917.2Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 and Content Analysis System (CAS) 1.3 before 1.3.7.4 are susceptible to an OS com CVE-2016-90928.8The Symantec Content Analysis (CA) 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) 1.1 management consoles are susceptible to a cro CVE-2016-90937.0A version of the SymEvent Driver that shipped with Symantec Endpoint Protection 12.1 RU6 MP6 and earlier fails to properly sanitize logged-i CVE-2016-90947.8Symantec Endpoint Protection clients place detected malware in quarantine as part of the intended product functionality. The quarantine logs CVE-2016-90977.2The Symantec Advanced Secure Gateway (ASG) 6.6 prior to 6.6.5.8, ProxySG 6.5 prior 6.5.10.6, ProxySG 6.6 prior to 6.6.5.8, and ProxySG 6.7 p CVE-2016-90996.1Symantec Advanced Secure Gateway (ASG) 6.6, ASG 6.7 prior to 6.7.2.1, ProxySG 6.5 prior to 6.5.10.6, ProxySG 6.6, and ProxySG 6.7 prior to 6