CVE-2025-15623

CVE-2025-15623 is an information disclosure vulnerability affecting Sparx Systems Pty Ltd's Sparx Pro Cloud Server that allows unauthenticated users to retrieve database passwords in plaintext under certain conditions. The vulnerability exposes both private personal information and sensitive system credentials to unauthorized actors, representing a critical control plane compromise for affected deployments. The attack requires no authentication and presents a straightforward attack vector with low complexity, enabling any network-accessible user to potentially extract database credentials. While a complete CVSS score has not been published, the FAUCET risk score of 43.0/100 indicates moderate severity with meaningful organizational impact, particularly given the exposure of system authentication materials. Currently, there is no evidence of active exploitation in the wild, and the vulnerability is not listed on the KEV catalog or the hot vulnerabilities list. However, the non-zero EPSS score suggests exploitation is technically possible, and organizations running affected Sparx Pro Cloud Server instances should prioritize patching to prevent credential compromise and unauthorized database access.