HIGHCVSS v4 8.6Vulnerability
CVE-2026-111492
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
Properties
- Cvss score
- 8.6
- First seen
- 2026-11-05T21:53:32+00:00
- Last seen
- 2026-11-05T21:53:32+00:00
- Euvd assigner
- INCIBE
- Retrieved at
- 2026-11-06T07:34:21+00:00
- Src batch id
- euvd-20261106T073401Z-826fba
- Source url
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117816
- Score
- 8.6
- Euvd base score version
- 4.0
- Fetched at
- 2026-11-06T07:34:21+00:00
- Euvd vendor
- TPC Software
- Cvss vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- First seen by Signal
- 2026-11-06T01:34:22+00:00
- Euvd base score
- 8.6
- Vector
- CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Content hash
- 79adda69252fe2a256626b424a3c799881ebebfbaba5b516cc02b874f61af79a
- Published at
- 2026-11-05T22:17:43.887
- Last modified
- 2026-11-05T22:36:02.320
- Euvd updated
- 2026-11-05T21:53:32+00:00
- Euvd epss pct
- 0
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph