HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-97324 — A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026....

·Source: NIST NVD

Updated:

Executive Summary

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated

Analysis

A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/demo/PayDemoOrderController.java of the component Demo-order Payment Callback Handler. The manipulation of the argument ID leads to improper authorization. The attack can be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way. CVSS Score: 7.3. Published: 2026-09-24T20:17:35.553.

Indicators of Compromise (1)

CVE (1)
CVE-2026-97324
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 24, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says

Sean Cairncross said CEOs need to be cognizant of how it’s being used, however. The post US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says appeared first on CyberScoop .

CyberScoop
CRITICALVulnerabilityNEW

Cyberattacks to be insured like accidents: Ministry of Finance discusses new rules for critical infrastructure

Roman Zaharov reports: Cyberattacks may start to be insured according to the principle already in effect for hazardous facilities. The Russian Ministry of Finance is discussing the possibility of making cyber risk insurance mandatory for businesses associated with critical infrastructure. This was stated by Deputy Finance Minister Ivan Chebeskov on the sidelines of the Moscow... Source

DataBreaches.net
LOWVulnerability

Shocker: suspected ShinyHunters member charged with attempted incitement to commit two murders

Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder. Here’s what we know so far. A 24-year-old Dutch national who previously served time for hacking-related crimes... Source

DataBreaches.net