Description
TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
Published: 2026-10-14
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via JavaScript injection
Action: Immediate Patch
AI Analysis

Impact

A Code Injection flaw in TeamPlus Messenger allows an unauthenticated attacker to embed crafted JavaScript in content that, after a user confirms a Windows security warning, gets executed with the privileges of the user. This enables arbitrary code execution on the victim’s machine and is classified as CWE‑94.

Affected Systems

The vulnerability affects TeamPlus Messenger from TeamPlus Technology. Versions prior to 17.0.7 are vulnerable; upgrading to 17.0.7 or later eliminates the flaw.

Risk and Exploitability

The CVSS score is 8.6, indicating a high severity. The EPSS score is below 1 %, suggesting a low likelihood of widespread exploitation. The vulnerability is not listed in CISA KEV. Attackers must deliver crafted content that could trigger JavaScript injection, and coerce the user into confirming the security warning, after which the malicious JavaScript runs as the current user.

Generated by OpenCVE AI on October 16, 2026 at 01:32 UTC.

Remediation

Vendor Solution

TeamPlus Messenger version 17.0.7 and later

OpenCVE Recommended Actions

  • Upgrade TeamPlus Messenger to version 17.0.7 or newer
  • Block or sanitize crafted content that could trigger JavaScript injection until a patch is deployed
  • Disable automatic execution of JavaScript within the messenger, or restrict script sources via content security policy if supported

Generated by OpenCVE AI on October 16, 2026 at 01:32 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
First Time appeared Teamplus Technology
Teamplus Technology teamplus Messenger
Vendors & Products Teamplus Technology
Teamplus Technology teamplus Messenger

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 03:00:00 +0000

Type Values Removed Values Added
Description TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windows security warning, attackers can execute arbitrary code with the privileges of the current user.
Title TEAMPLUS TECHNOLOGY｜TeamPlus Messenger - Code Injection
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Teamplus Technology Teamplus Messenger
cve-icon MITRE

Status: PUBLISHED

Assigner: twcert

Published:

Updated: 2026-10-16T15:31:53.506Z

Reserved: 2026-10-14T01:58:48.336Z

Link: CVE-2026-110445

cve-icon Vulnrichment

Updated: 2026-10-16T15:29:55.774Z

cve-icon NVD

Status : Deferred

Published: 2026-10-14T03:17:20.527

Modified: 2026-10-16T16:17:03.837

Link: CVE-2026-110445

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T13:09:33Z

Weaknesses
  • CWE-94

    Improper Control of Generation of Code ('Code Injection')