CVE-2026-110445: TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this vulnerability?
The attacker does not need to authenticate, but must persuade a user to interact with crafted content and then confirm a Windows security warning. Successful exploitation depends on that user interaction.
What access could an attacker gain after successful exploitation?
An attacker can inject and execute arbitrary JavaScript and, after the Windows warning is confirmed, execute arbitrary code with the privileges of the current user. The resulting impact includes confidentiality, integrity, and availability effects.
Who is exposed to this issue?
Users of TeamPlus Messenger are exposed when they interact with attacker-crafted content and confirm the associated Windows security warning. The provided information does not identify affected versions or state whether default configurations are affected.