• Project: Joomla!
  • SubProject: Site client
  • Severity: Moderate
  • Versions: 1.5.11 and all previous 1.5 releases
  • Exploit type: XSS
  • Reported Date: 2009-June-03
  • Fixed Date: 2009-June-30


An attacker can inject JavaScript code in a URL that will be executed in the context of targeted user browser.

Affected Installs

All 1.5.x installs prior to and including 1.5.11 are affected.


Upgrade to latest Joomla! version (1.5.12 or newer).


The JSST at the Joomla! Security Centre.

Reported By: Paul Boekholt (Byte Internet)