TPC Software vulnerabilities
We track 5 vulnerabilities in TPC Software products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on November 5, 2026.
Latest TPC Software vulnerabilities
- 9.1 Critical severity
Matchpoint: Improper Certificate Validation
Incorrect validation of TLS certificates in the MatchPoint Android app due to a TrustManager that accepts any certificate and a permissive hostname validator. Additionally, the app allows unencrypted HTTP traffic. An attacker capable of intercepting the victim
- 8.7 High severity
Matchpoint: Missing Authentication for Critical Functionality
Lack of authentication and authorization in the Images.ashx endpoint in MatchPoint, which allows profile photos to be downloaded using predictable identifiers. An unauthenticated remote attacker could enumerate these identifiers and collect users' photos. Link
- 8.6 High severity
Matchpoint: Improper Neutralization of Special Elements used in an SQL Command
SQL injection in the push notification handler of the MatchPoint Android app, which processes messages from Firebase Cloud Messaging and constructs queries by concatenating untrusted data. An attacker capable of interacting with the component could manipulate
- 9.9 Critical severity
Matchpoint: Authorization Bypass Through User-Controlled Key
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API, which relies on the `actingasuser` HTTP header without verifying the requester's authorization for the specified user. Manipulation of sequential identifiers allows access to personal
- 9.9 Critical severity
Matchpoint: Use of Hard-coded Credentials
A static credential embedded in the mobile app has been reported to return the 'autorizado' token on the MatchPoint platform. The report states that this token grants unauthenticated access to API services.