A vulnerability exists in go2ismail’s Asp.Net-Core-Inventory-Order-Management-System up to version 9.20250118 within an unspecified administrative interface function. By manipulating a client‑side redirect, an attacker can cause the application to execute code after the redirect, effectively enabling remote execution of unauthorized instructions. This weakness is classified under CWE‑698 and CWE‑705, indicating that application‑specific permissions and unsafe redirect handling are the root causes.

The affected software is go2ismail’s Asp.Net-Core-Inventory-Order-Management-System, versions prior to and including 9.20250118. No other vendors or versions are listed.

The CVSS base score is 5.3, placing the flaw in the moderate range. The current EPSS score is below 1 %, suggesting that exploitation attempts are expected to be rare, yet the vulnerability is publicly disclosed and could be leveraged remotely. Because the flaw operates in the administrative interface, an attacker only needs to reach that portion of the application, possibly by supplying a crafted request that triggers an unsafe redirect. The flaw is not listed in the CISA KEV catalog, but the lack of a published patch means the risk persists until a fix is applied.