Detections
Analytics
Joomla 1.5.x < 5.4.9 / 6.0.x < 6.1.4 Multiple Vulnerabilities (joomla-6-1-4-5-4-9-security-bugfix-release)
medium Nessus Plugin ID 362485
Synopsis
A PHP application running on the remote web server is affected by multiple vulnerabilities.Description
According to its self-reported version, the instance of Joomla! running on the remote web server is 1.5.x prior to 5.4.9 or 6.0.x prior to 6.1.4. It is, therefore, affected by multiple vulnerabilities.- Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The profile.save controller did not check the login state of a user, allowing the creation of guest-level users on sites without active user registration. (CVE-2026-90907)
- Joomla! Core - [20260901] - XSS in HTMLHelper::link method in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - Lack of escaping leads to XSS vulnerabilities in the link method of the HTML Helper. (CVE-2026-90906)
- Joomla! Core - [20260915] - Core - XSS filter bypass in InputFilter via HTML5 entity decode mismatch in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 - The checkAttribute method normalized an attribute value before testing it against the 'javascript:' scheme regex, however without decoding HTML5 entities beforehand, causing an XSS vector. (CVE-2026-92231)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Joomla! version 5.4.9 / 6.1.4 or later.See Also
http://www.nessus.org/u?2cf22c3f
http://www.nessus.org/u?5c562315
http://www.nessus.org/u?6a6f762b
Plugin Details
Severity: Medium
ID: 362485
File Name: joomla_614_150.nasl
Version: 1.1
Type: Remote
Family: CGI abuses
Published: 10/2/2026
Updated: 10/2/2026
Configuration: Enable paranoid mode, Enable thorough checks (optional)
Supported Sensors: Nessus
Enable CGI Scanning: true
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 58.36
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2026-90907
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4
Risk Factor: Medium
Base Score: 6.9
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
CPE: cpe:/a:joomla:joomla%5c%21
Required KB Items: www/PHP, Settings/ParanoidReport, installed_sw/Joomla!
Patch Publication Date: 9/29/2026
Vulnerability Publication Date: 9/29/2026
Reference Information
CVE: CVE-2026-90906, CVE-2026-90907, CVE-2026-92231, CVE-2026-92232