BIT-JOOMLA-2026-92231 Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260915 - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities...

CVE-2026-92231

Joomla! Core - 20260915 - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities...

CVE-2026-92231 Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260915 - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities...

CVE-2026-92231 Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3

Joomla! Core - 20260915 - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the "javascript:" scheme regex, however without decoding HTML5 entities...

CVE-2026-92231

A Cross-Site Scripting (XSS) filter bypass exists in Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 . The vulnerability resides in the InputFilter component's checkAttribute method, which fails to decode HTML5 entities before normalizing attribute values and testing them against the "javascrip...

PT-2026-102701

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 1.5.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 Description An XSS filter bypass exists in the InputFilter due to an HTML5 entity decode mismatch. The checkAttribute function normalized attribute values befo...