CVE-2025-15624
published 2026-04-17CVE-2025-15624: Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.38%
29.8th percentile
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.
In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sparx_systems_pty_ltd | sparx_pro_cloud_server | — | — |
| sparxsystems | pro_cloud_server | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Sparx Systems Sparx Pro Cloud Server 6.0.163 primary credentials storage
vuldb·2026-04-17·CVSS 9.3
CVE-2025-15624 [CRITICAL] Sparx Systems Sparx Pro Cloud Server 6.0.163 primary credentials storage
A vulnerability was found in Sparx Systems Sparx Pro Cloud Server 6.0.163 and classified as problematic. This issue affects the function primary. Executing a manipulation can lead to unprotected storage of credentials.
The identification of this vulnerability is CVE-2025-15624. The attack may be launched remotely. There is no exploit available.
GHSA
GHSA-9gf7-444h-6v98: Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd
ghsa_unreviewed·2026-04-17
CVE-2025-15624 [CRITICAL] CWE-256 GHSA-9gf7-444h-6v98: Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd
Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server.
In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-04-17
Published