TPC Software

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 5.1MediumNov 5, 2026TPC Software MatchpointCVE-2026-111495API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The vendor distinguishes the extracted elements from Google Maps and Firebase keys that must remain on the client side and considers them project identifiers, not authentication secrets. The impact depends on the capabilities and restrictions of each exposed element.
• 9.1CriticalNov 5, 2026TPC Software Matchpoint Crypto / certificateCVE-2026-111494Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim's traffic could read and modify communications, including credentials and personal data.
• 8.7HighNov 5, 2026TPC Software Matchpoint Auth bypass / access controlCVE-2026-111493Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
• 8.6HighNov 5, 2026TPC Software Matchpoint SQL injectionCVE-2026-111492SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.
• 6.9MediumNov 5, 2026TPC Software MatchpointCVE-2026-111491Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.
• 9.9CriticalNov 5, 2026TPC Software Matchpoint Auth bypass / access controlCVE-2026-111490Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal, banking, and financial data, private messages, and QR codes for physical access, as well as the ability to modify third-party accounts, change passwords, impersonate users, and transfer virtual balances.
• 9.9CriticalNov 5, 2026TPC Software MatchpointCVE-2026-111489A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.

See every TPC Software entry on the dashboard.

Top products

• Matchpoint7 CVEs in the last year, 3 critical

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• ENISA EUVD · Nov 5, 2026EUVD-2026-117822 · API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted…CVE-2026-111495
• ENISA EUVD · Nov 5, 2026EUVD-2026-117820 · Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts…CVE-2026-111494
• ENISA EUVD · Nov 5, 2026EUVD-2026-117818 · Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile…CVE-2026-111493
• ENISA EUVD · Nov 5, 2026EUVD-2026-117816 · SQL injection in the push notification handler of the MatchPoint Android app, which processes messages…CVE-2026-111492