TeamPlus Messenger Code Injection Flaws

Code injection in TeamPlus Messenger allows unauthenticated remote attackers to trick a user into interacting with crafted content, injecting and executing arbitrary JavaScript; after the user confirms a Windows security warning, arbitrary code executes with the victim's privileges. The CVSS 4.0 vector scores 8.6 (High) with UI:A, gated by two distinct user actions: interacting with the malicious content and then accepting an OS-level security prompt. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Remote code execution in TeamPlus Messenger for Windows lets an unauthenticated attacker deliver a crafted link that injects and executes arbitrary JavaScript inside the client, escalating to native code execution with the privileges of the logged-in user once the victim opens the link and confirms a Windows security warning dialog. Rated CVSS 4.0 base 8.6 (High) and mapped to CWE-94, the flaw's practical severity is gated by two mandatory victim actions - following the malicious link and accepting the Windows prompt - so only users who both act are compromised, and execution is confined to user-level privileges rather than SYSTEM or administrative rights. At the time of analysis no public exploit code was identified and the issue was not listed in CISA KEV; only TWCERT/CC advisory references are available, and no vendor patched version is specified in the provided data.