{"id":"CVE-2026-110445","title":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability","summary":"TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user con…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-94"],"vendor":"TEAMPLUS TECHNOLOGY","product":"TeamPlus Messenger","affected":["teamplus_messenger >= 16.8.0 <= 17.0.6"],"published":"2026-10-14","updated":"2026-10-16","sourceUpdated":"2026-10-16T16:17:03.837","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-110445","references":[{"url":"https://www.twcert.org.tw/en/cp-139-11271-be75e-2.html","label":"twcert@cert.org.tw"},{"url":"https://www.twcert.org.tw/tw/cp-132-11270-88d86-1.html","label":"twcert@cert.org.tw"}],"tags":["nvd","cve.org"],"epss":0.00584,"epssPercentile":0.47699,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:15:13.259186Z"},"ingestedAt":"2026-10-14T04:12:54.303Z","slug":"CVE-2026-110445","body":"## Overview\n\nTeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":49,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}