Skip to content
CVE PROGRAM SOURCE RECORD9.5 Critical

CVE-2026-21627

Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Joomla

Description

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

tassos.gr Novarain/Tassos Framework (plg_system_nrframework)

Default version status: unaffected

  • 4.10.14–6.0.37affected

tassos.gr Convert Forms

Default version status: unaffected

  • 3.2.12–5.1.0affected

tassos.gr EngageBox

Default version status: unaffected

  • 6.0.0–7.1.0affected

tassos.gr Google Structured Data

Default version status: unaffected

  • 5.1.7–6.1.0affected

tassos.gr Advanced Custom Fields

Default version status: unaffected

  • 2.2.0–3.1.0affected

tassos.gr Smile Pack

Default version status: unaffected

  • 1.0.0–2.1.0affected

References