CVE-2026-110444

Summary

TeamPlus Messenger contains a code injection vulnerability that allows unauthenticated remote attackers to inject arbitrary JavaScript into user sessions. When users click on a malicious link and confirm a Windows security warning, attackers can execute arbitrary code with the user's privileges.

Exploitability

Exploitation is moderately difficult as it requires social engineering to get users to click a crafted link and then confirm a Windows security warning, but once triggered, execution is straightforward.

Blast radius

The vulnerability could impact any user who clicks on a malicious link in TeamPlus Messenger, potentially leading to full system compromise with the privileges of the logged-in user.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

No fixed version is published. Disable the affected feature or restrict access to the vulnerable endpoint until a patch is available.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.