Source: Ministry of education information & communication security contingency platform
| Publication Number | TACERT-ANA-2026101503100101 | Publication Time | 2026-10-15 15:51:03 |
| Incident Type | ANA-Vulnerability Alert | Discovery Time | 2026-10-15 15:51:03 |
| Impact Level | Low | ||
| [Subject] 【Vulnerability Alert】TeamPlus Technology｜TeamPlus Messenger - Two Vulnerabilities Exist |
|||
| [Content] Forwarded from TWCERTCC-200-202610-00000024 Two security vulnerabilities exist in TeamPlus Technology's TeamPlus Messenger product: 【TeamPlus Technology｜TeamPlus Messenger - Code Injection】(CVE-2026-110444, CVSS: 8.8) An unauthenticated remote attacker can trick a user into opening a specially crafted link to inject and execute arbitrary JavaScript, thereby executing arbitrary code with the privileges of the current user after the user confirms the security warning. 【TeamPlus Technology｜TeamPlus Messenger - Code Injection】(CVE-2026-110445, CVSS: 8.8) An unauthenticated remote attacker can trick a user into interacting with specially crafted content to inject and execute arbitrary JavaScript, thereby executing arbitrary code with the privileges of the current user after the user confirms the security warning. Information Sharing Level: WHITE (Information content can be publicly disclosed) |
|||
| [Affected Platform] TeamPlus Messenger versions v16.8.0 through v17.0.6 |
|||
| [Recommended Actions] Update to TeamPlus Messenger version v17.0.7 or later (inclusive) |
|||
|
[Reference] |
|||