---
id: "CVE-2026-111492"
page: "https://infrastack.ai/live/CVE-2026-111492"
kind: "vulnerability"
aliases: ["CVE-2026-111492"]
title: "MatchPoint Android app: push handler SQL injection exposes local database data"
severity: "high"
cvss: 8.6
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "MatchPoint Android app", "fixed": [], "affected": "unknown (versions described in the report)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["android", "firebase-cloud-messaging", "matchpoint", "mobile-app", "package", "tpc-software"]
not_affected_if: ["no-matchpoint-installed", "other-app-versions"]
published_at: "2026-11-05T22:17:43+00:00"
first_seen_at: "2026-11-05T22:46:06+00:00"
updated_at: "2026-11-05T22:49:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111492", "first_seen_at": "2026-11-05T22:46:06+00:00"}, {"source": "analyst", "url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint", "first_seen_at": "2026-11-05T22:49:12+00:00", "cites": ["https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"]}]
exploit_sources: []
---

# MatchPoint Android app: push handler SQL injection exposes local database data

Link for people: https://infrastack.ai/live/CVE-2026-111492 (this .md is for agents)

The MatchPoint Android app builds database queries by concatenating data from Firebase Cloud Messaging push notifications without sanitizing it. An attacker who can send the component crafted input could read sensitive information from the app's local database, including stored credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:MatchPoint Android app affected unknown (versions described in the report) fixed no fixed version listed

## How to check

Check whether the MatchPoint (TPC Software) Android app is installed and whether it is the latest version in Google Play. No affected version range is published; INCIBE says only 'versions described in the report'.

## Fix

TPC Software recommends installing the latest available MatchPoint Android app version (INCIBE-2026-841). No specific fixed version number is published.

## Timeline

- 2026-11-05T22:46:06+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111492
- 2026-11-05T22:49:12+00:00 analyst https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint — INCIBE-2026-841 (CNA advisory) read. No affected version range or fixed version given; vendor TPC Software only says install latest app version. Attacker position (who can send crafted push data) not stated; CVSS AV:L. No exploitation or PoC found.

## Documents

- [advisory] INCIBE-2026-841: Multiple Vulnerabilities in TPC Software's MatchPoint https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint

## From the sources

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_