Code Injection Vulnerability in TeamPlus Messenger by Teamplus Technology
CVE-2026-110445

8.6HIGH

Key Information:

Vendor

Teamplus Technology

Status
Teamplus Messenger
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110445?

TeamPlus Messenger by Teamplus Technology is susceptible to a code injection vulnerability that allows unauthenticated remote attackers to exploit the application. By deceiving users into interacting with maliciously crafted content, attackers can trigger the execution of arbitrary JavaScript. If the user agrees to a Windows security warning, the attackers can run arbitrary code under the current user's privileges, leading to potential system compromise.

Affected Version(s)

TeamPlus Messenger 16.8.0 <= 17.0.6

References

https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-11271-be75e-2.html
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.