Vendors / Sparx Systems Records 15 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 5
CVSS high 6
Exploited now Sparx Systems records in CISA KEV No Sparx Systems vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority HIGH 82
SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classifier dialog box..
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00629 · Published 2024-01-31 · No fix listed CWE-89
Priority MEDIUM 50
Sparx Pro Cloud Server requires authentication based on requested URL.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00941 · Published 2026-05-19 · No fix listed CWE-639
Priority MEDIUM 48
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.0038 · Published 2026-04-17 · No fix listed CWE-256
Priority MEDIUM 48
Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd.
CVSS 4.0 CRITICAL 9.3· Network · No auth · No interaction · EPSS 0.00261 · Published 2026-04-17 · No fix listed CWE-359
Priority MEDIUM 47
Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database.
CVSS 4.0 HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00598 · Published 2026-05-19 · No fix listed CWE-863
Priority MEDIUM 43
Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.
CVSS 4.0 CRITICAL 9.5· Network · No auth · No interaction · EPSS 0.0042 · Published 2026-04-17 · No fix listed CWE-200
Priority MEDIUM 43
Improper Limitation of a Pathname caused a Path Traversal vulnerability in Sparx Systems Pro Cloud Server.
CVSS 4.0 HIGH 8.3· Network · High privileges · No interaction · EPSS 0.0076 · Published 2025-05-09 · Fixed in 6.0.165 CWE-20
Priority MEDIUM 40
Sparx Enterprise Architect software has a security feature that limits user's actions to those specified in the role.
CVSS 4.0 HIGH 8.7· Network · Low privileges · No interaction · EPSS 0.00401 · Published 2026-05-19 · No fix listed CWE-603
Priority LOW 37
Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint.
CVSS 4.0 HIGH 7.7· Network · Low privileges · No interaction · EPSS 0.00724 · Published 2026-05-19 · No fix listed CWE-362
Priority LOW 36
Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature.
CVSS 4.0 HIGH 8.2· Network · No auth · User interaction · EPSS 0.00332 · Published 2026-10-15 · No fix listed CWE-611
Priority LOW 32
Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to be executed by sending an specially crafted SQL query.
CVSS 4.0 HIGH 7.1· Network · Low privileges · No interaction · EPSS 0.00682 · Published 2026-05-19 · No fix listed CWE-228
Priority LOW 31
Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS).
CVSS 4.0 MEDIUM 5.3· Network · No auth · User interaction · EPSS 0.00657 · Published 2025-05-09 · Fixed in 6.0.165 CWE-79
Priority LOW 30
Cross-Site Request Forgery (CSRF) vulnerability in Sparx Systems Pro Cloud Server allows Cross-Site Request Forgery to perform Session Hijacking.
CVSS 4.0 MEDIUM 6.9· Network · High privileges · User interaction · EPSS 0.00324 · Published 2025-05-09 · Fixed in 6.0.165 CWE-352
Priority LOW 27
Insufficiently Protected Credentials vulnerability in Sparx Systems Pty Ltd.
CVSS 4.0 MEDIUM 6.2· Local · No auth · No interaction · EPSS 0.00155 · Published 2026-04-17 · Fixed in 17.1.1714 CWE-522
Priority LOW 24
Insufficiently Protected Credentials in Sparx Systems Pty Ltd.
CVSS 4.0 MEDIUM 5.7· Local · Low privileges · User interaction · EPSS 0.00106 · Published 2026-04-16 · Fixed in 17.1.1714 CWE-522
Open these records in search → All records by CVSS severity
5 6 4 0 0
THREATIST.IORead the docs