CVE-2026-111491

MediumCVSS 6.9/10Last modified Nov 10, 2026

Description

Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-256

Affected software

No affected versions have been published.

Timeline

Published: Nov 5, 2026
Last modified: Nov 10, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1114928.6SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and con CVE-2026-1114938.7Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predi CVE-2026-1114949.1Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive h CVE-2026-1114955.1API keys, credentials, and configuration parameters embedded in the MatchPoint APK, which can be extracted through reverse engineering. The CVE-2026-1114969.1Kafka Streams derives its stream-time clock from record timestamps. PunctuationSchedule.next() computed the next punctuation time as timesta CVE-2026-1114979.8A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows CVE-2026-1114984.4OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Resource Locking vulnerability. A high privileged attacker with local a CVE-2026-1114995.5Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low CVE-2026-11159.6A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prio CVE-2026-111506.1Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (U CVE-2026-1115008.8Dell OpenManage Enterprise, versions prior to 4.8.0, contains a Missing Authentication for Critical Function vulnerability. An unauthenticat CVE-2026-1115015.4Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Restriction of Excessive Authentication Attempts vulnerability. An