{"affected":[{"defaultStatus":"unaffected","product":"Matchpoint","source":"CNA: INCIBE","vendor":"TPC Software","versions":[{"status":"affected","version":"Versions prior to latest one"}]}],"cveId":"CVE-2026-111491","cwes":["CWE-256"],"description":"Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences. An attacker with access to the device's local data or a backup could retrieve usernames and passwords and use them to gain unauthorized access to accounts on the platform.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: INCIBE","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793915507817,"publishedAt":1793915507817,"references":[{"source":"CNA: INCIBE","tags":[],"url":"https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-tpc-softwares-matchpoint"}],"remediation":[{"kind":"fix","source":"CNA: INCIBE","text":"The manufacturer has announced the following measures. The server fixes for CVE-2026-111490 and CVE-2026-111493 have already been deployed and are applied regardless of the app version. To address the remaining vulnerabilities, it is recommended that you install the latest available version."}],"revision":"939d579ed29c908f324b2102a31db9f2ef7aeaf1a7a13ad28c9992cdb92fe80f","sources":[{"modifiedAt":1793915507817,"name":"CNA: INCIBE","retrievedAt":1793916755924,"url":"https://www.cve.org/CVERecord?id=CVE-2026-111491"}],"ssvc":null,"status":"published","title":"Credentials are stored in plain text in an SQLite database and in the MatchPoint Android app's SharedPreferences","updatedAt":1793916755924}