All 7 CVE vulnerabilities found in Matchpoint, with AI-generated Chinese analysis, references, and POCs.
Vendor: TPC Software
| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2026-111495 | API keys, credentials, and configuration parameters embedded in the MatchPoint APK | 5.1 | Medium | 2026-11-05 |
| CVE-2026-111494 | Incorrect validation of TLS certificates in the MatchPoint Android app CWE-295 | 9.1 | Critical | 2026-11-05 |
| CVE-2026-111493 | Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint CWE-306 | 8.7 | High | 2026-11-05 |
| CVE-2026-111492 | SQL injection in the push notification handler of the MatchPoint Android app CWE-89 | 8.6 | High | 2026-11-05 |
| CVE-2026-111491 | Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences CWE-256 | 6.9 | Medium | 2026-11-05 |
| CVE-2026-111490 | Insecure direct object reference (IDOR) vulnerability in the MatchPoint API CWE-639 | 9.9 | Critical | 2026-11-05 |
| CVE-2026-111489 | A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform | 9.9 | Critical | 2026-11-05 |
All 7 known CVE vulnerabilities affecting Matchpoint with full Chinese analysis, references, and POCs where available.