{"id":"EM-20261105-7AJ6","url":"https://cyber.eventmonitor.net/incident/EM-20261105-7AJ6/vulnerability-cve-2026-111492/","type":"cve","title":"Vulnerability (CVE-2026-111492)","subtitle":"CVE-2026-111492","subject":"CVE-2026-111492","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T22:17:43.887Z","firstSignal":"2026-11-05T21:53:32.000Z","lastSignal":"2026-11-05T22:17:43.887Z","updated":"2026-11-05T23:41:30.303Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T22:17:43.887Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T22:17:43.887Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T21:53:32.000Z","what":"First signal: C8 EU Vulnerability Database (EUVD)"},{"at":"2026-11-05T22:17:43.887Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-7AJ6 created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T22:17:43.887Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T22:17:43.887Z","detail":"CVSS 8.6"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T21:53:32.000Z","source":"C8","sourceName":"EU Vulnerability Database (EUVD)","role":"Database","severity":3,"title":"EUVD-2026-117816 / CVE-2026-111492 (score 8.6)","text":"SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117816"},{"at":"2026-11-05T22:17:43.887Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-111492 (CVSS 8.6)","text":"SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information from the local database, including credentials stored in the versions described in the report. The scope of the injection is limited to the device.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111492"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T22:17:43.887","score":8.6,"severity":"HIGH","desc":"SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate queries and access sensitive information","product":"","seen":1793922090303},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}