{"schema":"threatline.record/2","record":{"id":"CVE-2026-21627","aliases":[],"summary":"Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla","details":"The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.","categories":["Unclassified"],"product":"Novarain/Tassos Framework (plg_system_nrframework)","vendor":"tassos.gr","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","source_modified_at":"2026-02-23T05:07:12.296Z","fetched_at":"2026-10-25T11:14:20.449793Z","product":"Novarain/Tassos Framework (plg_system_nrframework)","vendor":"tassos.gr","versions":[{"status":"affected","version":"4.10.14–6.0.37"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","source_modified_at":"2026-02-23T05:07:12.296Z","fetched_at":"2026-10-25T11:14:20.449793Z","product":"Convert Forms","vendor":"tassos.gr","versions":[{"status":"affected","version":"3.2.12–5.1.0"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","source_modified_at":"2026-02-23T05:07:12.296Z","fetched_at":"2026-10-25T11:14:20.449793Z","product":"EngageBox","vendor":"tassos.gr","versions":[{"status":"affected","version":"6.0.0–7.1.0"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","source_modified_at":"2026-02-23T05:07:12.296Z","fetched_at":"2026-10-25T11:14:20.449793Z","product":"Google Structured Data","vendor":"tassos.gr","versions":[{"status":"affected","version":"5.1.7–6.1.0"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","source_modified_at":"2026-02-23T05:07:12.296Z","fetched_at":"2026-10-25T11:14:20.449793Z","product":"Advanced Custom Fields","vendor":"tassos.gr","versions":[{"status":"affected","version":"2.2.0–3.1.0"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","source_modified_at":"2026-02-23T05:07:12.296Z","fetched_at":"2026-10-25T11:14:20.449793Z","product":"Smile Pack","vendor":"tassos.gr","versions":[{"status":"affected","version":"1.0.0–2.1.0"}],"defaultStatus":"unaffected"}],"fixed_versions":[],"cvss":9.5,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.01753,"percentile":0.77765,"score_date":"2026-10-24"},"published_at":"2026-02-20T14:22:14.744Z","modified_at":"2026-02-23T05:07:12.296Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-21627","fetched_at":"2026-10-25T11:14:20.449793Z","source_modified_at":"2026-02-23T05:07:12.296Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-21627","fetched_at":"2026-10-25T11:14:20.449793Z","source_modified_at":"2026-10-24"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://tassos.gr","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-02-20T20:42:52.948106Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-02-23T05:07:12.296Z","content_hash":"a2b85ebde7eb07615853e5dd831addc2aa8cb7cd2252df8d2598add00d4aee8d"}}