Netanel Stern

**Name of the Vulnerable Software and Affected Versions** Joomla! Core versions 1.5.0 through 5.4.8 Joomla! Core versions 6.0.0 through 6.1.3 **Description** An XSS filter bypass exists in the InputFilter due to an HTML5 entity decode mismatch. The `checkAttribute()` function normalized attribute values before testing them against the "javascript:" scheme regex without first decoding HTML5 entities, which creates a vector for Cross-Site Scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.