Joomla Novarain/Tassos Framework Vulnerabilities Enables SQL injection and Unauthenticated File Read

A critical vulnerability in the Novarain/Tassos Framework plugin (plg_system_nrframework), bundled into several popular Joomla extensions, exposes an unauthenticated AJAX entry (task=include) that can be abused for arbitrary file reads, file deletions, and SQL injection; chaining these primitives can yield administrator session theft, backend access, and persistent remote code execution. Administrators are advised to immediately apply vendor patches, disable the plugin temporarily if exposed, and monitor/compress com_ajax traffic and logs for suspicious include requests or unexpected file operations.