CVE-2026-111491 Details
Description
Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
A vulnerability exists in the MatchPoint Android app by TPC Software, where credentials are stored in plain text within an SQLite database and the app's SharedPreferences. This flaw allows an attacker with access to the device's local data or a backup to retrieve usernames and passwords, potentially leading to unauthorized access to user accounts on the platform.
Users are advised to install the latest available version of the MatchPoint app. The manufacturer has announced that server fixes for related vulnerabilities have already been deployed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-256 | Plaintext Storage of a Password | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TPC Software MatchPoint | All versions |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | New CVE Received | [email protected] |