CVE-2025-15623

The vulnerability encompasses two classes of errors: disclosure of private personal data to unauthorized entities (CWE-359) and exposure of sensitive system information outside the permitted control zone (CWE-497). Under specific conditions, the application exposes the database password in plaintext form without verifying the identity of the requester. An attacker can remotely, without logging in, obtain access to this data over the network.

An attacker can obtain database credentials, enabling unauthorized access to its resources, reading, modification, or exfiltration of data stored in the system.

Apply patches available from the vendor according to the references: https://sparxsystems.com/products/procloudserver/6.1/history.html

Sparx Systems Pty Ltd. Sparx Pro Cloud Server — specific versions indicated in the vendor references (release history available at the reference address)