TPC Software vulnerabilities

Products

• Matchpoint 7

Latest TPC Software CVEs

Newest publication first

1. CVE-2026-111495 API keys, credentials, and configuration parameters embedded in the MatchPoint APK

   Published 2026-11-05

   Medium·CVSS 5.1

   API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them projec...

2. CVE-2026-111494 Incorrect validation of TLS certificates in the MatchPoint Android app

   Published 2026-11-05

   Critical·CVSS 9.1

   Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could rea...

3. CVE-2026-111493 Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint

   Published 2026-11-05

   High·CVSS 8.7

   Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to...

4. CVE-2026-111492 SQL injection in the push notification handler of the MatchPoint Android app

   Published 2026-11-05

   High·CVSS 8.6

   SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access s...

5. CVE-2026-111491 Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences

   Published 2026-11-05

   Medium·CVSS 6.9

   Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the plat...

6. CVE-2026-111490 Insecure direct object reference (IDOR) vulnerability in the MatchPoint API

   Published 2026-11-05

   Critical·CVSS 9.9

   Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financi...

7. CVE-2026-111489 A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform

   Published 2026-11-05

   Critical·CVSS 9.9

   A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.