MATCHPOINT ANDROID APP · CVE-2026-111492 · Package
NO FIX YET · SEE WHAT TO DO
The MatchPoint Android app builds database queries by concatenating data from Firebase Cloud Messaging push notifications without sanitizing it. An attacker who can send the component crafted input could read sensitive information from the app's local database, including stored credentials.
first public Nov 5, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
People using the MatchPoint Android app (TPC Software sports facility platform). The flaw is in the app's Firebase Cloud Messaging push handler, which builds database queries from untrusted data; the injection is limited to the device and could expose the app's local database, including stored credentials. The advisory names no affected version range and does not say who must be able to send the input. Anyone without the app can skip it.
Not affected if no-matchpoint-installed, other-app-versions
Who cares android, firebase-cloud-messaging, matchpoint, mobile-app, tpc-software
versions described in the reportSQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
This page as .md · .json · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.