Back Cybersecuritynews

Joomla Novarain/Tassos Framework Vulnerabilities Enables SQL injection and Unauthenticated File Read

Cybersecuritynews •Abinaya • February 16, 2026

Websites running the Novarain/Tassos Framework are vulnerable to critical security flaws that allow unauthenticated file read, file deletion, and SQL injection attacks, potentially leading to remote code execution and full administrator takeover on unpatched systems. The issues affect multiple popular Tassos extensions and require urgent patching through the vendor’s updated releases. A source‑code review of […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Joomla Novarain/Tassos Framework Vulnerabilities Enable SQL Injection and RCE A source code review of the Novarain/Tassos framework has revealed three critical vulnerabilities: unauthenticated file read, unauthenticated file deletion, and SQL injection. These vulnerabilities affect five widely deployed Joomla! extensions and can be exploited to achieve remote code execution (RCE) and administrator account takeover on unpatched Joomla! instances. 3 sources 39

Extracted Entities

Joomla Novarain/Tassos Framework Vulnerabilities Enables SQL injection and Unauthenticated File Read

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

Platforms (2)