CVE-2026-110444

47th percentile - higher than 47% of all known CVEs

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

An attacker can execute arbitrary code with the privileges of the current user, potentially leading to system compromise or data theft. The risk is high because it only requires a user to click a crafted link.

Update TeamPlus Messenger to the latest version as soon as it becomes available. Inform users about the risks of clicking unknown links and consider restricting application privileges.