CVE-2026-111492
SQL injection in the push notification handler of the MatchPoint Android app
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
| CWE | CWE-89 |
| Vendor | tpc software |
| Product | matchpoint |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for tpc software matchpoint
Be the first to know when new unknown vulnerabilities affecting tpc software matchpoint are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
TPC Software / Matchpoint
Versions prior to latest one
References
Credits
Sergi García Tárraga