SQL injection in the push notification handler of the MatchPoint Android app
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. MatchPoint Android app with a push notification handler that processes Firebase Cloud Messaging messages and builds queries from untrusted data
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 19/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
SQL injection in the push notification handler of the MatchPoint Android app lets an attacker with local access to the device, and no login, read sensitive data from the app's local database, including stored credentials. The flaw comes from building database queries by concatenating untrusted message data from Firebase Cloud Messaging, and it does not extend beyond the device.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.6/10CVSS 8.6
- No patch5/5No patch listed yet
What would change the score
- Would score about 69 if added to CISA KEV
- Would score about 64 if CISA's SSVC rates exploitation active
- Would score about 29 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
MatchPoint Android app with a push notification handler that processes Firebase Cloud Messaging messages and builds queries from untrusted dataWorkaround: The checked facts do not describe a workaround. Until a fix is published, the advisory information available is limited to the push notification handler, and no mitigation steps are confirmed in the sources.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- TPC Software Matchpoint
Version range not reported
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-111492
Is CVE-2026-111492 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
Crafted data in Firebase Cloud Messaging push messages can be used to manipulate queries in the MatchPoint Android app's local database. This can expose sensitive information stored there, including credentials. The injection's scope is limited to the device.Source: incibe.es
Am I affected, and how do I check?
The flaw is in the push notification handler of the MatchPoint Android app, which processes Firebase Cloud Messaging messages and builds queries from their data. The checked facts do not list affected version numbers. To check an installed copy, look up the app's version under the Android app settings for MatchPoint.Source: incibe.es
How do I fix CVE-2026-111492?
The checked facts do not name a fixed version, so no upgrade target can be given. Check the TPC Software release notes for MatchPoint for an update that addresses this issue.Source: incibe.es
What if there's no patch?
The checked facts do not describe a workaround. Until a fix is published, the advisory information available is limited to the push notification handler, and no mitigation steps are confirmed in the sources.Source: incibe.es