CVE-2025-15625

BRIEFING NOTE - CVE-2025-15625 CVE-2025-15625 is an unauthenticated SQL injection vulnerability affecting Sparx Pro Cloud Server that allows attackers to execute arbitrary SQL commands against the underlying database under specific conditions. This vulnerability eliminates the need for authentication, significantly expanding the potential threat surface. The attack vector is network-based and exploitable without authentication, though specific attack complexity details are not available. A successful exploitation could lead to unauthorized data access, modification, or deletion within the database, representing a critical integrity and confidentiality risk. The FAUCET Risk Score of 44.0 out of 100 indicates moderate to significant concern within the security community. While the vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog, its presence on the Active Hot List suggests ongoing monitoring and potential exploitation activity. The low EPSS score of 0.00027 indicates this is relatively uncommon compared to other published vulnerabilities, though the active tracking status warrants immediate patching and monitoring efforts. Organizations running Sparx Pro Cloud Server should prioritize deploying available patches and implementing network-level controls to restrict database access.