# CVE-2026-111492: TPC Software MatchPoint SQL injection in push notification handler

Source: https://junglewise.ai/threats/cve-2026-111492-sql-injection-in-the-push-notification-handler-of-the-matchpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-111492 · Severity: info · Published 2026-11-05

MatchPoint is a sports facility management platform with both web and mobile components. An SQL injection vulnerability in the Android app's push notification handler allows an attacker with access to the device to extract sensitive information from the local database, including stored credentials. The vulnerability is limited to the device and does not affect the server or other users.

Technologies: [TPC Software MatchPoint](https://junglewise.ai/threats/technologies/matchpoint). Vendors: [TPC Software](https://junglewise.ai/threats/vendors/tpc-software).

## Quick answers

**Is CVE-2026-111492 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111492 being exploited in the wild.

**How severe is CVE-2026-111492?** Informational severity, published 5 November 2026.

**Which products and versions are affected?** TPC Software MatchPoint versions described in the report.

**Is there a fix for CVE-2026-111492?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-111492 attacked?** It is attacked with local access.

**Am I affected by CVE-2026-111492?** Check whether you run TPC Software MatchPoint at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

SQL injection vulnerability in the MatchPoint Android app's Firebase Cloud Messaging push notification handler, where untrusted message data is concatenated directly into database queries without sanitization. An attacker capable of sending or intercepting push messages can manipulate SQL queries to access the device's local SQLite database. The scope is limited to the device; no network-based exploitation is possible.

## Affected products

- TPC Software MatchPoint versions described in the report

## Timeline

- 2026-11-05: disclosed

## References

- [https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint](https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint)

## Related threats

- [TPC Software MatchPoint credentials and configuration extraction](https://junglewise.ai/threats/cve-2026-111495-api-keys-credentials-and-configuration-parameters-embedded-in)
- [TPC Software MatchPoint Android certificate validation bypass](https://junglewise.ai/threats/cve-2026-111494-incorrect-validation-of-tls-certificates-in-the-matchpoint)
- [TPC Software MatchPoint authentication bypass in Images.ashx endpoint](https://junglewise.ai/threats/cve-2026-111493-lack-of-authentication-and-authorization-in-the-images-ashx)
- [TPC Software MatchPoint authorization bypass in API](https://junglewise.ai/threats/cve-2026-111490-insecure-direct-object-reference-idor-vulnerability-in-the)
- [TPC Software MatchPoint hardcoded credential in mobile app](https://junglewise.ai/threats/cve-2026-111489-a-static-credential-embedded-in-the-mobile-app-has-been-reported)