CVE-2025-15625 is a critical SQL injection (CVSS 9.8) in Sparx Systems Pro Cloud Server. An unauthenticated user can run arbitrary SQL commands against the server's database in certain cases. The record does not name affected or fixed versions, so check the vendor's release history and update.
What's affected
The record says an unauthenticated user can execute arbitrary SQL commands in the Pro Cloud Server database in certain cases. It does not list an affected version range or a fixed version.
The reference is the vendor's release history page for Pro Cloud Server 6.1. I could not load that page from my tools because of a bot challenge, so I cannot confirm which build contains the fix. Do not guess from this post. Open the history page and look for the entry that mentions the SQL fix, and note its build number.
Pro Cloud Server is the web service that lets teams share Sparx Enterprise Architect models over HTTP, usually backed by a database.
How to check if you're exposed
Check the version of your Pro Cloud Server from its configuration tool or the service's reported version, then compare it with the vendor's release history for the 6.1 line and any later builds.
Next, find out who can reach the service. The vulnerability needs no login, so exposure to the internet is the largest risk factor. Check your firewall and reverse proxy rules for the port the server listens on, and check whether the service sits behind a VPN or an allowlist.
Review web logs for requests with unusual characters in parameters, and database logs for errors raised by the account the service uses.
What to do now
- Find every Pro Cloud Server and its build number.
- Read the vendor's release history, find the SQL injection fix, and install that build or a later one.
- Until you update, restrict the service to your VPN or known addresses.
- Reduce the rights of the database account used by the service to the minimum it needs.
- Review logs for unexpected queries and consider rotating the database credentials.
Why it matters
The record lists CWE-89, SQL Injection, and CWE-200, Exposure of Sensitive Information. The service builds a database command from request data without a firm separation of code and data, so crafted input can alter the command. With no authentication required, anyone who can reach the service can try it.
The CVSS vector is network based, no privileges, no interaction, and high impact on confidentiality, integrity and availability (9.8). The record does not list the CVE in CISA's Known Exploited Vulnerabilities catalog. Modeling servers often hold architecture diagrams and design documents, so the data is sensitive even if not customer facing.
Testing your own web apps for injection
Dynamic scanning sends test input to a running web app and watches how it responds. Use it only on systems you own. The free in-browser dependency scan at https://gold.safeguard.sh/scan checks a manifest against known vulnerabilities without installing anything. The Gold directory pages for each CVE and CWE collect the same facts in one place.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which build fixes it?
The record does not say and the vendor page could not be loaded from my tools. Check Sparx's Pro Cloud Server release history for the fix.
Is a login needed to attack it?
The record says an unauthenticated user can run SQL commands in certain cases, so exposure to untrusted networks is the main concern.
Sources
Last reviewed: 19 October 2026.
