# Exploit for Joomla 3.4.4 - 3.6.4 (CVE-2016-8869 and CVE-2016-8870) with File Upload web shell
1. https://github.com/XiphosResearch/exploits/blob/master/Joomraa/joomraa.py
# 后台RCE
Affected version: Joomla core <=3.9.24
User requirement: Admin account (Not Superadmin)
Gain access: Create superadmin, then trigger RCE.
2. https://github.com/HoangKien1020/CVE-2021-23132