CVE-2026-111493: high-severity vulnerability in TPC Software Matchpoint
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.7epss 0.5%
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Linking these photos to identities may be facilitated by other vulnerabilities in the platform.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
TPC Software · MatchpointRelated CVEs — TPC Software Matchpoint
In the same product, most dangerous first.
CVE-2026-111490CRITICALInsecure direct object reference (IDOR) vulnerability in the MatchPoint APIEPSS 0.4%CVE-2026-111489CRITICALA static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platformEPSS 0.3%CVE-2026-111494CRITICALIncorrect validation of TLS certificates in the MatchPoint Android appEPSS 0.2%CVE-2026-111492HIGHSQL injection in the push notification handler of the MatchPoint Android appEPSS 0.2%CVE-2026-111495MEDIUMAPI keys, credentials, and configuration parameters embedded in the MatchPoint APKEPSS 0.1%CVE-2026-111491MEDIUMCredentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferencesEPSS 0.1%