{"id":"CVE-2026-110445","published":"2026-10-14T03:17:20.527","lastModified":"2026-10-16T16:17:03.837","description":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwes":["CWE-94"],"vendors":[],"products":[],"references":[{"url":"https://www.twcert.org.tw/en/cp-139-11271-be75e-2.html","tags":[]},{"url":"https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"TeamPlus Messenger contains a code injection vulnerability that allows unauthenticated attackers to inject arbitrary JavaScript into user sessions. When users interact with malicious content and confirm a Windows security warning, attackers can execute arbitrary code with the user's privileges, potentially leading to full system compromise.","exploitability":"Exploitation is moderately difficult as it requires social engineering to get users to interact with crafted content and confirm a Windows security warning, but once triggered, execution is straightforward with no additional prerequisites.","blast_radius":"The vulnerability could impact any user who interacts with malicious TeamPlus Messenger content, potentially affecting organizations that rely on this messaging platform for business communications, with risk escalating based on user privileges and network access.","remediation":"Upgrade to TeamPlus Messenger version 2.590 or later to remediate this code injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["code-injection","web","rce"],"model":"garnet-coder","analyzedAt":"2026-10-18T10:26:09.548Z"}}