Threat database

CVE-2025-15625 is a critical SQL injection vulnerability in Sparx Pro Cloud Server version 6.0.163 that allows unauthenticated users to execute arbitrary SQL commands on the backend database under certain conditions. This vulnerability arises from improper neutralization of special elements in SQL commands (CWE-89). The vulnerability has a high CVSS 4.0 score of 9.5, reflecting its critical impact. No official patch or remediation guidance is currently available from the vendor, and no known exploits have been reported in the wild. Due to the lack of a vendor advisory or patch, organizations should monitor for updates and apply fixes once available.

CVE-2025-15624 is a critical vulnerability in Sparx Systems Pty Ltd. 's Sparx Pro Cloud Server version 6.0.163 where local passwords created for users during OpenID authentication are stored in plaintext. This improper storage of passwords (CWE-256) exposes sensitive credentials to potential unauthorized access. The vulnerability has a high CVSS 4.0 score of 9.3, indicating significant risk if exploited. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2025-15623 is a critical vulnerability in Sparx Systems Pty Ltd. 's Sparx Pro Cloud Server version 6.0.163 that allows an unauthenticated user to retrieve the database password in plaintext under certain conditions. This exposure of private personal and sensitive system information could lead to unauthorized access and compromise of the system. The vulnerability has a high CVSS 4.0 score of 9.3, indicating critical severity. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2025-15622 is a medium severity vulnerability in Sparx Systems Pty Ltd. 's Sparx Enterprise Architect version 16.1.1627. The vulnerability involves insufficient protection of OAuth2 client credentials, where the desktop client reveals the plaintext OAuth2 client secret. This secret is decoded and used in the OpenID authentication flow to exchange for access and ID tokens. There is no official patch or remediation level currently provided by the vendor, and no known exploits in the wild have been reported.

Insufficiently Protected Credentials in Sparx Systems Pty Ltd. Sparx Enterprise Architect. Client does not verify the receiver of OAuth2 credentials during OpenID authentication