CVE-2021-35964: Learningdigital.com, Inc. Orca HCM - Broken Authentication

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-19 · updated 2026-06-17
Weakness: CWE-285

Description

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.

Affected products

Learningdigital.com, Inc. Orca HCM: through 10.0

References

https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
https://www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html
https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25
https://www.twcert.org.tw/tw/cp-132-4924-f74d5-1.html

Get alerted when CVE-2021-35964 or the next vulnerability affects your stack