CVE-2025-15624

⚠️ high

Summary

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

CVSS Score

7.5

High

EPSS Score

0.0

Exploit Probability

Published Date

2026-04-17

First Seen: 2026-04-20

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 69.0% of all 326,604 vulnerabilities in our database.

#101,315

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Apr 17, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Total

Complete system compromise possible

🏆 Discovered By

Pasi Orovuo, Solita Oy Henri Hämäläinen, Solita Oy Samu Ahvenainen, Solita Oy

SSVC data provided by CISA

Last Modified 2026-06-02

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS Vector 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red

CWE IDs (Weakness Types)

CWE-256

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
sparxsystems	pro_cloud_server	Affected	v6.0.163

🔗 References 1

https://sparxsystems.com/products/procloudserver/6.1...

Release Notes

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-42096	⚠️ high	8.8	0.1	Sparx Pro Cloud Server is vulnerable to Broken Access Control within communication with the database. Due to lack of per...	2026-05-19
CVE-2026-42097	⚠️ high	8.8	0.2	Sparx Pro Cloud Server requires authentication based on requested URL. An attacker can omit the "model" query paramete...	2026-05-19
CVE-2026-42099	⚠️ high	7.5	0.3	Sparx Pro Cloud Server is vulnerable to a Race Condition in the /data_api/dl_internal_artifact.php endpoint. The applica...	2026-05-19
CVE-2026-42100	⚠️ high	7.5	0.1	Improper Handling of Syntactically Invalid Structure in Sparx Pro Cloud Server allows Denial of Service (DoS) attack to ...	2026-05-19
CVE-2025-15623	⚠️ high	7.5	0.1	Exposure of Private Personal Information to an Unauthorized Actor, : Exposure of Sensitive System Information to an Unau...	2026-04-17
CVE-2025-15625	⛔ critical	9.8	0.0	Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.	2026-04-17

These CVEs affect the same products