Well yes but no with html5 a lot of JavaScript functions are now possible with html alone so a number of stuff like click or core having or even SQL injections into local databases are now possible with html5 even with JavaScript disabled