{"id":"CVE-2026-111491","title":"Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences","summary":"Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain …","severity":"medium","cvss":6.9,"cvssVector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-256"],"vendor":"TPC Software","product":"Matchpoint","affected":["Matchpoint Versions prior to latest one"],"published":"2026-11-05","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:51:47.817Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111491","references":[{"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"}],"tags":["cve.org"],"ingestedAt":"2026-11-05T23:41:31.960Z","epss":0.00119,"epssPercentile":0.01769,"slug":"CVE-2026-111491","body":"## Overview\n\nCredentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.\n\n## Affected\n\n- `Matchpoint Versions prior to latest one`\n\n## Remediation\n\nThe manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.","depth":"sunlit","depthScore":38,"depthScoreParts":{"impact":38,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}