CVE-2026-3262

MEDIUM

Asp.Net-Core-Inventory-Order-Management-System <9.20250118 - Open R...

Title source: llm

Description

A vulnerability has been found in go2ismail Asp.Net-Core-Inventory-Order-Management-System up to 9.20250118. Affected is an unknown function of the component Administrative Interface. Such manipulation leads to execution after redirect. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (4)

Core 4

Core References

Permissions Required, VDB Entry vdb-entry

https://vuldb.com/?id.347985

Permissions Required, VDB Entry signature permissions-required

https://vuldb.com/?ctiid.347985

Permissions Required, VDB Entry third-party-advisory

https://vuldb.com/?submit.758333

Third Party Advisory exploit

https://github.com/Ghufran2/CVE-Asp.Net-Core-Inventory-Order-Management-System-Advisories/blob/main/Asp.Net-Core-Inventory-Order-Management-System%20Privilege%20Escalation%20via%20Client-Side%20Redirect%20Bypass.md

View Writeup ZIP pw:eip

Scores

CVSS v3 6.3

EPSS 0.0042

EPSS Percentile 33.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-698 CWE-705

Status published

Products (1)

go2ismail/asp.net-core-inventory-order-management-system < 9.20250118

Published Feb 26, 2026

Tracked Since Feb 27, 2026