In Joomla! before 3.9.19, the default settings of the global textfilter configuration do not block HTML inputs for Guest users.
{ "cpes": [ "cpe:2.3:a:joomla:joomla!:*:*:*:*:*:*:*:*" ], "severity": "High" }
"https://github.com/bitnami/vulndb/tree/main/data/joomla/BIT-joomla-2020-13763.json"