BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-111493Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint

Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.

8.7 HIGHEPSS 0.48%Not in KEVNVD: Deferred

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
8.7HIGH4.0INCIBE (CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Details

CVE ID
CVE-2026-111493
Status
Deferred
Assigner (CNA)
INCIBE
Published
Nov 5, 2026
Last modified
2026-11-05 22:36 UTC
Weaknesses
  • CWE-306 · Missing authentication for critical function

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:21 UTC.