{"id":"CVE-2026-111492","kind":"vulnerability","aliases":["CVE-2026-111492"],"related":[],"title":"MatchPoint Android app: push handler SQL injection exposes local database data","description":"SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.","summary":"The MatchPoint Android app builds database queries by concatenating data from Firebase Cloud Messaging push notifications without sanitizing it. An attacker who can send the component crafted input could read sensitive information from the app's local database, including stored credentials.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"MatchPoint Android app","fixed":[],"affected":"unknown (versions described in the report)","ecosystem":"vendor"}],"ecosystems":[],"tags":["android","firebase-cloud-messaging","matchpoint","mobile-app","package","tpc-software"],"not_affected_if":["no-matchpoint-installed","other-app-versions"],"how_to_check":"Check whether the MatchPoint (TPC Software) Android app is installed and whether it is the latest version in Google Play. No affected version range is published; INCIBE says only 'versions described in the report'.","fix":"TPC Software recommends installing the latest available MatchPoint Android app version (INCIBE-2026-841). No specific fixed version number is published.","status":"open","published_at":"2026-11-05T22:17:43+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","triaged_at":"2026-11-05T22:46:36+00:00","updated_at":"2026-11-05T22:49:12+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T22:46:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"MatchPoint Android app: push handler SQL injection exposes local database data","impact":"medium","summary":"The MatchPoint Android app builds database queries by concatenating data from Firebase Cloud Messaging push notifications without sanitizing it. An attacker who can send the component crafted input could read sensitive information from the app's local database, including stored credentials.","audience":"everyone","category":"package","nicknames":[],"who_cares":["android","matchpoint","firebase-cloud-messaging"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"local database contents and stored credentials readable by an attacker","analyst_note":"Check the NVD entry and the vendor's advisory for affected versions, a fixed release, and whether an attacker needs a push-sending position to trigger the handler.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-app-versions","no-matchpoint-installed"],"who_is_affected":"Users of the MatchPoint Android app in the versions described in the report. The injection is limited to the device, so the exposure is to data stored locally on the phone rather than on a company server. The sources do not name the affected version range or a fixed release.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":4242,"output_tokens":478,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the vendor's advisory for affected versions, a fixed release, and whether an attacker needs a push-sending position to trigger the handler.","search":"'-111492':14A,17A '-2026':13A,16A 'access':113C 'android':2A,19A,21B,36B,85C 'app':3A,20A,29B,37B,68B,86C 'attack':54B,102C 'build':38B 'capabl':103C 'cloud':24B,46B,92C 'compon':59B,108C 'concaten':42B,98C 'construct':95C 'could':62B,109C 'craft':60B 'credenti':74B,121C 'cve':12A,15A 'data':11A,43B,100C 'databas':10A,39B,71B,119C 'describ':126C 'devic':139C 'expos':8A 'firebas':23B,45B,91C 'firebase-cloud-messag':22B 'handler':5A,81C 'includ':72B,120C 'inform':65B,115C 'inject':7A,76C,134C 'input':61B 'interact':105C 'limit':136C 'local':9A,70B,118C 'manipul':110C 'matchpoint':1A,18A,26B,35B,84C 'messag':25B,47B,89C,93C 'mobil':28B 'mobile-app':27B 'notif':49B,80C 'packag':30B 'process':88C 'push':4A,48B,79C 'queri':40B,96C,111C 'read':63B 'report':129C 'sanit':51B 'scope':131C 'send':57B 'sensit':64B,114C 'softwar':33B 'sql':6A,75C 'store':73B,122C 'tpc':32B 'tpc-softwar':31B 'untrust':99C 'version':125C 'without':50B","nicknames":[],"mitigations":[],"who_affected":"People using the MatchPoint Android app (TPC Software sports facility platform). The flaw is in the app's Firebase Cloud Messaging push handler, which builds database queries from untrusted data; the injection is limited to the device and could expose the app's local database, including stored credentials. The advisory names no affected version range and does not say who must be able to send the input. Anyone without the app can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"everyone","plain_action":"Update the MatchPoint app to the latest version in the Google Play Store.","pkeys":["androidapp","matchpointandroidapp"],"ptokens":["android","app","matchpoint"],"labels":["android","firebasecloudmessaging","high","matchpoint","mobileapp","package","tpcsoftware"],"campaign_type":null,"first_public_at":"2026-11-05T22:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve-coordination@incibe.es","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111492","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111492","severity":null,"published_at":"2026-11-05T22:17:43+00:00","modified_at":"2026-11-05T22:36:02+00:00","first_seen_at":"2026-11-05T22:46:06+00:00","fetched_at":"2026-11-05T22:46:06+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111492:1838","url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","severity":null,"published_at":"2026-11-05T22:49:12+00:00","modified_at":"2026-11-05T22:49:12+00:00","first_seen_at":"2026-11-05T22:49:12+00:00","fetched_at":"2026-11-05T22:49:12+00:00","note":"INCIBE-2026-841 (CNA advisory) read. No affected version range or fixed version given; vendor TPC Software only says install latest app version. Attacker position (who can send crafted push data) not stated; CVSS AV:L. No exploitation or PoC found.","cites":["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}],"documents":[{"id":81214,"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint","title":"INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}