CVE-2026-111494

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify...

CVE-2026-111493

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be...

CVE-2026-111495

API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, no...

CVE-2026-111492

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive...

CVE-2026-111491

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform...

CVE-2026-111490

Insecure direct object reference IDOR vulnerability in the MatchPoint API, which relies on the actingasuser HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private...

CVE-2026-111489

A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services...

CVE-2026-111495

The MatchPoint APK by TPC Software contains embedded API keys , credentials , and configuration parameters that can be extracted via reverse engineering . While the vendor notes that Google Maps and Firebase keys are standard client-side project identifiers rather than authentication secrets, the...

CVE-2026-111494

The MatchPoint Android app by TPC Software is vulnerable to incorrect validation of TLS certificates . The root cause is a TrustManager that accepts any certificate combined with a permissive hostname validator. Furthermore, the application permits unencrypted HTTP traffic . These flaws allow an ...

CVE-2026-111493

The MatchPoint software by TPC Software contains a lack of authentication and authorization in the Images.ashx endpoint. This vulnerability allows an unauthenticated remote attacker to download profile photos by using predictable identifiers to enumerate and collect images. The documentation sugg...

CVE-2026-111492

The MatchPoint Android app is vulnerable to SQL injection within its push notification handler. The application processes messages from Firebase Cloud Messaging and insecurely constructs database queries by concatenating untrusted data. An attacker capable of interacting with this component can m...

CVE-2026-111491

The MatchPoint Android app by TPC Software contains a vulnerability where credentials are stored in plain text within an SQLite database and the app's SharedPreferences . An attacker who gains access to the device's local data or a backup can retrieve usernames and passwords to gain unauthorized ...

CVE-2026-111490

The MatchPoint API is vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability. The flaw exists because the API relies on the actingasuser HTTP header without properly verifying if the requester is authorized to act as the specified user. By manipulating sequential identifiers, an a...

CVE-2026-111489

The MatchPoint platform by TPC Software is affected by a vulnerability where a static credential embedded within the mobile application returns an 'autorizado' token . This flaw allows for unauthenticated access to the platform's API services . No specific patch version or workaround is provided ...