CVE-2025-15624

critical · 9.3

Plaintext Storage of a Password vulnerability in Sparx Systems Pty Ltd. Sparx Pro Cloud Server. In a setup where OpenID is used as the primary method of authentication to authenticate to Sparx EA, Pro Cloud Server creates local passwords to the users and stores them in plaintext.

9.3

CVSS

0.4%

EPSS (exploit prob.)

32nd

EPSS percentile

2026-04-17

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:X/V:C/RE:M/U:Red

Weaknesses

CWE-256

Affected products

Vendor	Product	Affected versions
sparxsystems	pro_cloud_server	6.0.163

Check a specific version with /api/v1/cve/match.

References

https://sparxsystems.com/products/procloudserver/6.1/history.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-15624