CVE-2025-15625

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89CWE-200

Affected software

VendorProductVersions
Sparx Systems Pty Ltd.Sparx Pro Cloud Server6.0.163

References

Timeline

Published
Apr 17, 2026
Last modified
Oct 7, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-156265.3Authenticated user can bypass authorization in Ribblr - Crochet & Knitting iOS applicationCVE-2025-156277.5A cryptographic weakness exists in the Omada adoption protocol.  The protocol relies on hard-coded cryptographic keys to establish trust andCVE-2025-156287.5Affected Omada devices rely on embedded certificates that are shared across deployments to establish trust between controllers and managed dCVE-2025-156297.5A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllCVE-2025-156305.9A race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflowCVE-2025-156315.9A cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does noCVE-2025-156323.5A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component CVE-2025-156336.5An improper authorization vulnerability in HCL BigFix WebUI allows an authenticated user without Master Operator privileges to access internCVE-2025-156344.3A missing authorization vulnerability in HCL BigFix WebUI allows an authenticated user without proper permissions to view sensitive environmCVE-2025-156354.3Cross-Site Request Forgery (CSRF) vulnerability in ZAYTECH Smart Online Order for Clover clover-online-orders allows Cross Site Request ForgCVE-2025-156366.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design YouTube Showcase youtubCVE-2025-156378.1Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2025-15625: Critical severity, CVSS 9.8 | Vulnix