CVE-2026-111494

Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify...

CVE-2026-111491

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform...

CVE-2026-111494

The MatchPoint Android app by TPC Software is vulnerable to incorrect validation of TLS certificates . The root cause is a TrustManager that accepts any certificate combined with a permissive hostname validator. Furthermore, the application permits unencrypted HTTP traffic . These flaws allow an ...

CVE-2026-111492

The MatchPoint Android app is vulnerable to SQL injection within its push notification handler. The application processes messages from Firebase Cloud Messaging and insecurely constructs database queries by concatenating untrusted data. An attacker capable of interacting with this component can m...