CVE-2026-111492

HighCVSS 8.6

Published: 05/11/2026(UTC)Updated: 05/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Summary

The MatchPoint Android app contains a SQL injection vulnerability in its push notification handler. The component processes Firebase Cloud Messaging messages and builds queries by concatenating untrusted data. An attacker able to interact with the component could manipulate queries and access sensitive information from the local database, including stored credentials.

Risk Assessment

Potential leakage of local app database data, including stored credentials, putting user data on the device at risk. The scope of the injection is limited to the device.

Recommendation

Update the MatchPoint app to a version that fixes the vulnerability and avoid installing the versions described in the report. Use parameterized queries instead of concatenating input data.

Other vulnerabilities in MatchPoint Android app

CVE-2026-111494Critical
The MatchPoint Android app incorrectly validates TLS certificates due to a TrustManager that accepts any certificate and a permissive hostname validator. The app also allows unencrypted HTTP traffic, enabling an attacker who intercepts traffic to read and modify communications, including credentials and personal data.

Original NVD description (English source)

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS