TPC Software has 7 CVEs on record. Disclosure cadence is accelerating: 7 in the last 90 days against 0 in the 90 before. The busiest recent month was November 2026 with 7. The median CVSS is 8.7 (high), with 3 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.7
- Publish → KEV
- —
- Last 90 days
- 7 prev 0
Worst active — by depth score
CVE-2026-111490Critical· 9.9Insecure direct object reference (IDOR) vulnerability in the MatchPoint API54CVE-2026-111489Critical· 9.9A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform54CVE-2026-111494Critical· 9.1Incorrect validation of TLS certificates in the MatchPoint Android app50CVE-2026-111493High· 8.7Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint48CVE-2026-111492High· 8.6SQL injection in the push notification handler of the MatchPoint Android app47
TPC Software vulnerabilities
CVEs affecting TPC Software, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-111489Critical· 9.9A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.
CVE-2026-111490Critical· 9.9Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers al…
CVE-2026-111491Medium· 6.9Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain …
CVE-2026-111493High· 8.7Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and coll…
CVE-2026-111492High· 8.6SQL injection in the push notification handler of the MatchPoint Android app
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the comp…
CVE-2026-111494Critical· 9.1Incorrect validation of TLS certificates in the MatchPoint Android app
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of …
CVE-2026-111495Medium· 5.1API keys, credentials, and configuration parameters embedded in the MatchPoint APK
API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain o…