CVE-2025-15625CWE-200CWE-89sql-injectioninformation-disclosure

CVE-2025-15625

Critical · published April 17, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
35.3
In the wild
Unconfirmed
What it is

Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00420 · 35.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-17T13:16Z
Affected products (1)
ProductVersionsFixed in
sparxsystems/pro_cloud_serverall versions—
References (1)
https://sparxsystems.com/products/procloudserver/6.1/history.html · db4dfee8-a97e-4877-bfae-eba6d14a2166
EPSS history
Timeline
  • 17 APR 08:38Z
    Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server
    cvelistv5