All vulnerabilities
CVE-2026-21627

Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

tassos.gr Novarain/Tassos Framework (plg_system_nrframework)
Open in ThreatlineRecord JSON
CVSS
9.5Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)1.75%Chance of exploitation activity in the next 30 days, higher than 77% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published20 Feb 2026Updated 23 Feb 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Timeline

  1. 20 Feb 2026, 14:22 UTCPublishedCVE List
  2. 25 Oct 2026, 08:13 UTCExploit code publicGitHub proof-of-concept repositories

Reports 1

1 outlet mention it. Reports are not confirmation; each links to its source.

Description

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

Text from CVE List

Affected versions 6

  • Novarain/Tassos Framework (plg_system_nrframework)affected: 4.10.14–6.0.37CVE List
  • Convert Formsaffected: 3.2.12–5.1.0CVE List
  • EngageBoxaffected: 6.0.0–7.1.0CVE List
  • Google Structured Dataaffected: 5.1.7–6.1.0CVE List
  • Advanced Custom Fieldsaffected: 2.2.0–3.1.0CVE List
  • Smile Packaffected: 1.0.0–2.1.0CVE List

References 1