Detections
Analytics

Joomla 1.5.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)

high Nessus Plugin ID 362485

Language:

Synopsis

A PHP application running on the remote web server is affected by multiple vulnerabilities.

Description

According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities.

 - Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. (CVE-2026-90907)

 - Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper. (CVE-2026-90906)

 - Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the 'javascript:' scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector. (CVE-2026-92231)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Joomla! version 5.4.9 / 6.1.4 or later.

See Also

http://www.nessus.org/u?2cf22c3f

http://www.nessus.org/u?5c562315

http://www.nessus.org/u?6a6f762b

http://www.nessus.org/u?832125e4

http://www.nessus.org/u?f083342d

Plugin Details

Severity: High

ID: 362485

File Name: joomla_614_150.nasl

Version: 1.4

Type: Remote

Family: CGI abuses

Published: 10/2/2026

Updated: 10/7/2026

Configuration: Enable paranoid mode, Enable thorough checks (optional)

Supported Sensors: Nessus

Enable CGI Scanning: true

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.18

CVSS v2

Risk Factor: High

Base Score: 8

Temporal Score: 5.9

Vector: CVSS2#AV:N/AC:L/Au:M/C:C/I:C/A:P

CVSS Score Source: CVE-2026-92231

CVSS v3

Risk Factor: High

Base Score: 8.3

Temporal Score: 7.2

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2026-90906

CVSS v4

Risk Factor: High

Base Score: 8.4

Threat Score: 7.1

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-92232

Vulnerability Information

CPE: cpe:/a:joomla:joomla%5c%21

Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/Joomla!

Exploit Ease: No known exploits are available

Patch Publication Date: 9/29/2026

Vulnerability Publication Date: 9/29/2026

Reference Information

CVE: CVE-2026-90906, CVE-2026-90907, CVE-2026-92231, CVE-2026-92232

IAVA: 2026-A-1067