Joomla: >> Joomla! >> 1.6 Security Vulnerabilities
Joomla! Core - [20260916] - Core - XSS filter bypass in InputFilter via whitespace characters in HTML data URIs in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The cleanAttribute method removes HTML data URIs, however injected whitespaces characters could circumvent that cleanup, causing an XSS vector.
CVSS Score
7.1
EPSS Score
0.002
Published
2026-09-29
Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector.
CVSS Score
7.1
EPSS Score
0.003
Published
2026-09-29
Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration.
CVSS Score
6.9
EPSS Score
0.002
Published
2026-09-29
Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper.
CVSS Score
5.9
EPSS Score
0.002
Published
2026-09-29
Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did not include SHTML files. On servers that executed these files, that could lead to code execution.
CVSS Score
8.9
EPSS Score
0.006
Published
2026-08-18
Improper handling of identifiers lead to a SQL injection vulnerability in the quoteNameStr method of the database package. Please note: the affected method is a protected method. It has no usages in the original packages in neither the 2.x nor 3.x branch and therefore the vulnerability in question can not be exploited when using the original database class. However, classes extending the affected class might be affected, if the vulnerable method is used.
CVSS Score
9.8
EPSS Score
0.005
Published
2025-04-08
Inadequate parsing of URLs could result into an open redirect.
CVSS Score
4.3
EPSS Score
0.005
Published
2024-02-29
Joomla! 1.7.1 has core information disclosure due to inadequate error checking.
CVSS Score
7.5
EPSS Score
0.016
Published
2020-02-04
Joomla! core 1.7.1 allows information disclosure due to weak encryption
CVSS Score
7.5
EPSS Score
0.011
Published
2020-02-04
Multiple Cross-site Scripting (XSS) vulnerabilities exist in Joomla! through 1.7.0 in index.php in the search word, extension, asset, and author parameters.
CVSS Score
5.4
EPSS Score
0.008
Published
2020-01-22
Page 1