The vulnerability presents an improper information disclosure where an unauthenticated user can retrieve the database password exposed in plaintext. This exposes sensitive system credentials, permitting attackers to authenticate to the underlying database or compromise other services. The weakness aligns with CWE-359 and CWE-497 semantics.

The affected product is Sparx Pro Cloud Server provided by Sparx Systems Pty Ltd. No specific version number was supplied in the public data, so any release that has not yet been confirmed as patched remains vulnerable.

The CVSS score of 9.3 places the vulnerability in the critical range, indicating that exploitation is high risk. Although no EPSS score is supplied, the lack of existing measures and the straightforward nature of retrieving a password from an unauthenticated request suggest that attackers can easily exploit the flaw. The vulnerability is not yet listed in the CISA KEV catalog, but the high CVSS and exposure of credentials warrant immediate action. An attacker with network access to the Sparx Pro Cloud Server can potentially send a crafted request and obtain the database password in plaintext without needing to authenticate.