Code Injection Vulnerability in TeamPlus Messenger by Teamplus Technology
CVE-2026-110444

8.6HIGH

Key Information:

Vendor

Teamplus Technology

Status
Teamplus Messenger
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110444?

TeamPlus Messenger, developed by Teamplus Technology, contains a code injection vulnerability that allows unauthenticated remote attackers to exploit users into opening specially crafted links. This exploitation can lead to the injection and execution of arbitrary JavaScript code on the user's device. Upon confirming a Windows security alert, attackers may gain the ability to execute code with the current user's privileges, posing a significant risk to system integrity.

Affected Version(s)

TeamPlus Messenger 16.8.0 <= 17.0.6

References

https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11271-be75e-2.html
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.