CVE-2025-15625 Unauthenticated execution of arbitrary SQL queries in Sparx Pro Cloud Server
Unauthenticated attackers can execute arbitrary SQL commands in Sparx Pro Cloud Server, leading to potential data exposure or modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-15625?
CVE-2025-15625 is a critical SQL injection vulnerability in Sparx Pro Cloud Server, published on 17 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Unauthenticated user is able to execute arbitrary SQL commands in Sparx Pro Cloud Server database in certain cases.
Which versions are affected by CVE-2025-15625?
It affects 1 product.
Products include Sparxsystems Pro Cloud Server.
How do I fix CVE-2025-15625?
No fix has been published for CVE-2025-15625 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2025-15625 being exploited?
There is no known exploitation of CVE-2025-15625 in the wild and no public exploit code.
Other vulnerabilities in Sparx Pro Cloud Server
- CVE-2026-42097 Authentication Bypass in Sparx Pro Cloud Server
- CVE-2025-15623 Sparx Pro Cloud Server reveals sensitive information to an unauthenticated user
- CVE-2025-15624 Plaintext Storage of a Password in Sparx Pro Cloud Server.
- CVE-2026-42096 Broken Access Control in Sparx Pro Cloud Server
- CVE-2026-42099 Race Condition in Sparx Pro Cloud Server
Sources
Also known as GHSA-cpjc-5x9w-83h8.