CVE-2018-16659

9.8 criticalEPSS 2.7%

Critical (9.8) in rausoft id.prove. EPSS 2.7% chance of exploitation in the next 30 days.

An issue was discovered in Rausoft ID.prove 2.95. The login page allows SQL injection via Microsoft SQL Server stacked queries in the Username POST parameter. Hypothetically, an attacker can utilize master..xp_cmdshell for the further privilege elevation.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.7% chance of exploitation in the next 30 days; higher than 86% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2018-09-28
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

rausoft:id.prove

References

https://www.exploit-db.com/exploits/45500/
https://www.exploit-db.com/exploits/45500/

Check your stack JSON