Forwarded from the TWCERT/CC Security Alert TWCERTCC-200-202610-00000024
The 互動資通 product TeamPlus Messenger has 2 security vulnerabilities:
【互動資通｜TeamPlus Messenger - Code Injection】(CVE-2026-110444, CVSS: 8.8) An unauthenticated remote attacker can lure a user into opening a specially crafted link, inject and execute arbitrary JavaScript, and then execute arbitrary code with the current user's privileges after the user confirms the security warning.
【互動資通｜TeamPlus Messenger - Code Injection】(CVE-2026-110445, CVSS: 8.8) An unauthenticated remote attacker can lure a user into interacting with specially crafted content, inject and execute arbitrary JavaScript, and then execute arbitrary code with the current user's privileges after the user confirms the security warning.