Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user
Priority MEDIUM 48CWE-359Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-359.
Summary
Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. Unauthenticated user can retrieve database password in plaintext in certain situations
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00261 17th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sparx Systems | Sparx Pro Cloud Server | 6.0.163 | — | No fix listed | CNA |
- Sparx Pro Cloud Server VendorSparx Systems Affected 6.0.163 Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:* | 6.0.163 | Vulnerable | Sparx Systems |
- cpe:2.3:a:sparxsystems:pro_cloud_server:6.0.163:*:*:*:*:*:*:* Versions 6.0.163 Vulnerable ·Sparx Systems
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-15623
- 2026-10-03 Alias added: GHSA-mqmv-fjj3-cwjx
References
More Sparx Systems Pro Cloud Server vulnerabilities
- TI-2026-30463 Authentication Bypass in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.3
- TI-2025-14252 Plaintext Storage of a Password in Sparx Pro Cloud Server. CVSS 4.0CRITICAL 9.3
- TI-2026-30462 Broken Access Control in Sparx Pro Cloud Server CVSS 4.0HIGH 8.7
- TI-2025-14253 Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server CVSS 4.0CRITICAL 9.5
- TI-2026-30465 Race Condition in Sparx Pro Cloud Server CVSS 4.0HIGH 7.7
- TI-2026-30466 DoS in Sparx Pro Cloud Server CVSS 4.0HIGH 7.1
Sources
- CVE-2025-15623 · CVE Program
- CVE-2025-15623 · NVD
- FIRST EPSS
- GHSA-mqmv-fjj3-cwjx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences