CVE-2026-110445

47th percentile - higher than 47% of all known CVEs

TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.

An attacker can execute arbitrary code with the privileges of the current user, potentially leading to system compromise or data theft. The risk is high because it only requires user interaction with crafted content.

Update TeamPlus Messenger to the latest version as soon as it becomes available. Inform users about the risks of interacting with unknown content and consider restricting application privileges.