tassos.gr vulnerabilities and threats

Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.

Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.

CVE-2026-77026 is a vulnerability in the tassos.gr Convert Forms extension for Joomla that allows client-side validation to be bypassed. This affects versions 1.0.0 through 4.4.16 and 5.0.0 through 5.2.5. The flaw enables attackers to circumvent CAPTCHA and field validation protections because the security enforcement relies on client-side controls rather than server-side validation.

The Convert Forms extension for Joomla versions 2.5.0 through 5.2.2 contains an improper access control vulnerability in its front-end Submissions view. This flaw allows unauthenticated visitors to list form submissions, leading to sensitive data exposure. The vulnerability is identified as CWE-284 (Improper Access Control) and CWE-200 (Information Exposure). It has a high severity rating with a CVSS score of 8.2. No official patch or remediation guidance is currently available from the vendor.

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.