---
id: CVE-2026-111492
title: SQL injection in the push notification handler of the MatchPoint Android app
summary: >-
  SQL injection in the push notification handler of the MatchPoint Android app,
  which processes messages from Firebase Cloud Messaging and constructs queries
  by concatenating untrusted data. An attacker capable of interacting with the
  comp…
severity: high
cvss: 8.6
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-89
vendor: TPC Software
product: Matchpoint
affected:
  - Matchpoint Versions prior to latest one
published: '2026-11-05'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:53:32.301Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-111492'
references:
  - url: >-
      https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint
tags:
  - cve.org
ingestedAt: '2026-11-05T23:41:31.959Z'
epss: 0.00152
epssPercentile: 0.04427
---

## Overview

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.

## Affected

- `Matchpoint Versions prior to latest one`

## Remediation

The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version.