CVE-2026-111492
SQL injection in the push notification handler of the MatchPoint Android app, which processes…
- Risk score
- 52/100
- CVSS
- 8.6 v4.0
- Published
- 5 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local dat…
- Affected
- See advisory
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.6 high
References
Original description
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
Last activity 5 Nov 2026. Patch Forecast updates every hour.