CVE-2026-21627 — Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 f…

CVE-2026-21627

Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla PUBLISHED

Description (CNA)

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

Affected (CNA)

Vendor / product	Versions
tassos.gr / Novarain/Tassos Framework (plg_system_nrframework)	affected 4.10.14–6.0.37
tassos.gr / Convert Forms	affected 3.2.12–5.1.0
tassos.gr / EngageBox	affected 6.0.0–7.1.0
tassos.gr / Google Structured Data	affected 5.1.7–6.1.0
tassos.gr / Advanced Custom Fields	affected 2.2.0–3.1.0
tassos.gr / Smile Pack	affected 1.0.0–2.1.0

CWE

CWE-284

References

https://tassos.gr

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.