Loading story…
Sparx Systems Pro Cloud Server was assigned two high-severity vulnerabilities affecting authentication and database security. CVE-2025-15624 describes a plaintext password storage issue that occurs when OpenID is used as the primary authentication method for Sparx EA, causing Pro Cloud Server to generate local user passwords and store them in plaintext. The flaw is mapped to CWE-256 and was scored with a CVSS v4.0 vector indicating network exposure, low attack complexity, no privileges required, and high confidentiality and integrity impact.
A second issue, CVE-2025-15625, allows an unauthenticated attacker to execute arbitrary SQL queries against the Pro Cloud Server database in certain cases. The vulnerability is mapped to CWE-89 and CWE-200, and its CVSS v4.0 vector indicates remote exploitation without privileges or user interaction, though with high attack complexity. Both CVEs reference Sparx Systems Pro Cloud Server 6.1 history information, linking the disclosures to vendor-documented product changes and fixes.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
On April 17, 2026, new CVE entries were recorded for two Sparx Pro Cloud Server issues: CVE-2025-15624, involving plaintext storage of locally created passwords when OpenID is used as the primary authentication method, and CVE-2025-15625, involving unauthenticated execution of arbitrary SQL queries in certain cases. The CVEs were classified under CWE-256, CWE-89, and CWE-200 and referenced Sparx Systems Pro Cloud Server 6.1 history information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers have been exploiting **SonicWall Gen6 SSL-VPN** appliances through `CVE-2024-12802`, a flaw that can let users with valid credentials bypass MFA when devices rely on LDAP with different handling for Active Directory `UPN` and `SAM` login formats. ReliaQuest reported intrusions between February and March 2026 in which attackers brute-forced VPN accounts, gained access in as few as 13 attempts, and moved laterally within 30 minutes, with activity linked to ransomware tradecraft including attempted **Cobalt Strike** deployment and efforts to disable endpoint protection. SonicWall said some Gen6 systems remain exposed even after firmware updates unless administrators also complete six manual LDAP reconfiguration steps in advisory `SNWLID-2025-0001`; Belgium's CCB separately warned organizations to patch multiple SonicWall vulnerabilities immediately. At the same time, **Sparx Systems Pro Cloud Server** and **Enterprise Architect** were flagged for multiple severe vulnerabilities, including broken access control, authentication bypass, client-side authentication weakness, a race-condition-based remote code execution issue, and a denial-of-service bug tied to malformed SQL input. CERT Polska said the flaws affect Pro Cloud Server `6.1 build 167` and earlier and Enterprise Architect `17.1` and earlier, enabling arbitrary SQL execution, repository-wide compromise, malicious PHP file creation and execution, and service disruption; Belgium's CCB warned that some of the Sparx flaws are being actively exploited and urged immediate patching.
Jun 29, 2026
Ivanti disclosed three high-severity vulnerabilities in **Ivanti Endpoint Manager (EPM)** affecting all versions up to and including **2024 SU6**, and directed customers to upgrade to **EPM 2024 SU7**. The issues include **`CVE-2026-18125`**, which allows an unauthenticated remote attacker to crash the EPM Agent service; **`CVE-2026-18127`**, which allows an authenticated attacker to gain write access to an Amazon S3 bucket used for session recording storage; and **`CVE-2026-18129`**, which allows a man-in-the-middle attacker to intercept cleartext credentials used for external SQL database connections. Public vulnerability records describe **`CVE-2026-18129`** as a cleartext transmission flaw in the EPM Core component before **2024 SU7**, with high potential impact despite requiring a man-in-the-middle position. Ivanti said fixes are included in **2024 SU7** and reported no evidence of active exploitation before disclosure, while the Canadian Centre for Cyber Security issued advisory **AV26-805** urging organizations to review Ivanti’s guidance and apply updates. Ivanti also recommended prioritizing patching for deployments using external SQL databases or S3-backed session logs and monitoring for agent crashes, unauthorized S3 writes, and unusual SQL authentication activity.
Aug 13, 2026
Researchers detailed how **CVE-2022-35405**, a pre-authentication remote code execution flaw in **Zoho/ManageEngine Password Manager Pro**, could let an internet-based attacker take over the password vault server through its XML-RPC functionality. The issue was tied to insecure deserialization behavior, aligning with broader OWASP guidance that deserialization flaws can allow untrusted data to trigger arbitrary code execution when applications process attacker-controlled objects. After gaining code execution on a vulnerable Password Manager Pro instance, red-team researchers showed they could reverse engineer the product’s server-side cryptography and recover sensitive secrets, including the stored database password, the master key, and plaintext managed credentials. Their analysis of the default PostgreSQL deployment found that the server’s ability to decrypt secrets on behalf of users created a **single point of failure**: once the PMP server was compromised, attackers could extract vaulted credentials and use them to escalate access, potentially reaching **Domain Admin** in enterprise environments.
Jul 24, 2026