BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-111492SQL injection in the push notification handler of the MatchPoint Android app

SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.

8.6 HIGHEPSS 0.15%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
8.6HIGH4.0INCIBE (CNA)CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Details

CVE ID
CVE-2026-111492
Status
Deferred
Assigner (CNA)
INCIBE
Published
Nov 5, 2026
Last modified
2026-11-05 22:36 UTC
Weaknesses
  • CWE-89 · Improper neutralization of special elements used in an SQL command ('SQL injection')

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:21 UTC.