This vulnerability (CVE-2025-15623) affects Sparx Pro Cloud Server version 6.0.163 and involves the exposure of private personal information and sensitive system data, specifically the database password in plaintext, to an unauthenticated attacker. The vulnerability is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor) and CWE-497 (Exposure of Sensitive Information to an Unauthorized Actor). The CVSS 4.0 vector indicates it can be exploited remotely without authentication or user interaction, with high impact on confidentiality and integrity. The vendor has not provided an official fix or remediation level, and the product is not a cloud service, so remediation is the responsibility of the user organization.

An unauthenticated attacker can obtain the database password in plaintext, potentially leading to unauthorized access to the database and further compromise of the system. This can result in exposure of sensitive personal and system information. The critical CVSS score (9.3) reflects the high impact on confidentiality and integrity with low attack complexity and no required privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently available, organizations should monitor vendor communications closely. Until a patch is released, restricting network access to the affected server and applying compensating controls to protect sensitive information may help reduce risk.