Joomla Vulnerabilities in Novarain/Tassos Framework Expose SQL Injection Risks

This report describes multiple critical vulnerabilities in the Novarain/Tassos Framework (plg_system_nrframework) used by several Joomla extensions that allow unauthenticated local file reads and deletions, SQL injection for arbitrary database reads, and an AJAX include pattern that can be chained to achieve administrator takeover and reliable remote code execution; affected products and versions are listed, vendor updates are available, and administrators are advised to patch, disable the plugin/extensions, or restrict ?option=com_ajax endpoints.