What’s Vulnerable › Vulnerabilities

CVE-2026-21627: Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla

• Severity: critical (CVSS 9.5 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-20 · updated 2026-06-17
• Weakness: CWE-284

Description

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.

Affected products

• tassos.gr Advanced Custom Fields: 2.2.0–3.1.0
• tassos.gr Convert Forms component for Joomla: 3.2.12–5.1.0
• tassos.gr EngageBox: 6.0.0–7.1.0
• tassos.gr Google Structured Data: 5.1.7–6.1.0
• tassos.gr Novarain/Tassos Framework (plg_system_nrframework): 4.10.14–6.0.37
• tassos.gr Smile Pack: 1.0.0–2.1.0

References

• https://tassos.gr

Get alerted when CVE-2026-21627 or the next vulnerability affects your stack