CVE-2026-3262

MEDIUM

Asp.Net-Core-Inventory-Order-Management-System <9.20250118 - Open R...

Title source: llm

Description

A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected is an unknown function of the component Administrative Interface. Such manipulation leads to execution after redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

[Permissions Required, VDB Entry] https://vuldb.com/?id.347985

[Permissions Required, VDB Entry] https://vuldb.com/?ctiid.347985

[Permissions Required, VDB Entry] https://vuldb.com/?submit.758333

[Third Party Advisory] https://github.com/Ghufran2/CVE-Asp.Net-Core-Inventory-Order-Management-System-Advisories/blob/main/Asp.Net-Core-Inventory-Order-Management-System%20Privilege%20Escalation%20via%20Client-Side%20Redirect%20Bypass.md

View Writeup ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0008

EPSS Percentile 23.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-698 CWE-705

Status published

Products (1)

go2ismail/asp.net-core-inventory-order-management-system < 9.20250118

Published Feb 26, 2026

Tracked Since Feb 27, 2026