Tpc Software Matchpoint
7 CVEs affecting Tpc Software Matchpoint. Latest disclosed: 2026-11-05. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-111495 | | 2026-11-05 | API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishe… | |
CVE-2026-111494 | | 2026-11-05 | Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator… | |
CVE-2026-111493 | | 2026-11-05 | Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers… | |
CVE-2026-111492 | | 2026-11-05 | SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by… | |
CVE-2026-111491 | | 2026-11-05 | Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local… | |
CVE-2026-111490 | | 2026-11-05 | Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's a… | |
CVE-2026-111489 | | 2026-11-05 | A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token… |