Sparx Systems Enterprise Architect version 17.1 is affected by an XML External Entity (XXE) injection vulnerability in its XSLT Debugger feature. This flaw allows processing of external entities from crafted XML files containing a DOCTYPE with external DTD references, enabling an attacker to read arbitrary files on the victim's filesystem. The vulnerability has a high severity with a CVSS 4.0 score of 8.2. Attempts to contact the vendor for remediation information were unsuccessful, and no patch information is currently available.
Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sending an specially crafted SQL query. This causes the Pro Cloud Server service to terminate unexpectedly.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The application downloads the properties of the object pointed by guid parameter and saves loaded content in current location (__DIR__) under the specified name. An attacker with repository access can control both the filename and file contents, allowing the creation of a malicious PHP file in a current directory. Although the file is deleted after processing, a race condition exists: if the response transmission is delayed (e.g., via a large file or slow client connection), the file remains accessible. During this window, the attacker can issue a second request to execute the malicious PHP file, resulting in remote code execution.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role. An authenticated attacker can modify the Enterprise Architect client behavior (e.g.using a debugger) and log in as any other user or administrator - then it is possible to do every possible change to the repository.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 17.1 and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query parameter and send the model name only in the binary blob in POST request allowing SQL query execution without authentication.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of permission checks, any low privileged user can run arbitrary SQL queries within database user context.
The vendor was notified early about this vulnerability, but didn't respond with the details of vulnerability or vulnerable version range. Only version 6.1 (build 167) and below were tested and confirmed as vulnerable, other versions were not tested and might also be vulnerable.
CVE-2025-15625 is a critical SQL injection vulnerability in Sparx Pro Cloud Server version 6.0.163 that allows unauthenticated users to execute arbitrary SQL commands on the backend database under certain conditions. This vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89). The vulnerability has a high CVSS 4.0 score of 9.5, reflecting its critical impact. No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported in the wild. Due to the lack of a vendor advisory or patch, organizations should monitor for updates and apply fixes once available.
CVE-2025-15624 is a critical vulnerability in Sparx Systems Pty Ltd. 's Sparx Pro Cloud Server version 6.0.163 where local passwords created for users during OpenID authentication are stored in plaintext. This improper storage of passwords (CWE-256) exposes sensitive credentials to potential unauthorized access. The vulnerability has a high CVSS 4.0 score of 9.3, indicating significant risk if exploited. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2025-15623 is a critical vulnerability in Sparx Systems Pty Ltd. 's Sparx Pro Cloud Server version 6.0.163 that allows an unauthenticated user to retrieve the database password in plaintext under certain conditions. This exposure of private personal and sensitive system information could lead to unauthorized access and compromise of the system. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2025-15622 is a medium severity vulnerability in Sparx Systems Pty Ltd. 's Sparx Enterprise Architect version 16.1.1627. The vulnerability involves insufficient protection of OAuth2 client credentials, where the desktop client reveals the plaintext OAuth2 client secret. This secret is decoded and used in the OpenID authentication flow to exchange for access and ID tokens. There is no official patch or remediation level currently provided by the vendor, and no known exploits in the wild have been reported.
Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication