A list of vulnerable extensions in Joomla can be found at https://vel.joomla.org/live-vel. More information about the Joomla architecture can be found at https://docs.joomla.org/Archived:CMS_Architecture_in_1.5_and_1.6.