In Joomla! 1.5.0 up to and including 3.6.5 (fixed in 3.7.0), inadequate filtering of multibyte characters leads to XSS vulnerabilities in various components.
joomla joomla\\!