CVE-2025-4376 - Cross-Site Scripting vulnerability in Model Search in Pro Cloud Server's WebEA

MEDIUM

Cross-Site Scripting vulnerability in Model Search in Pro Cloud Server's WebEA

Published May 9, 2025

5.3

MEDIUM

CVSS 4.0

EPSS 0.65%

Improper Input Validation vulnerability in Sparx Systems Pro Cloud Server's WebEA model search field allows Cross-Site Scripting (XSS).

This issue affects Pro Cloud Server: earlier than 6.0.165.

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
Sparx Systems	Pro Cloud Server	unaffected	Affected ≥ 0, ≤ 6.0.164 Unaffected 6.0.165

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14085		Advisory
https://sparxsystems.com/products/procloudserver/6.1/

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner NCSC-FI

Published May 9, 2025

Updated Aug 26, 2026

Reserved May 6, 2025

CISA Vulnrichment

Updated May 9, 2025

NVD

Status Deferred

Modified Aug 26, 2026

Red Hat

No data

ENISA EUVD

Assigner NCSC-FI

Published May 9, 2025

Updated Aug 26, 2026

GitHub

No data