Learning Digital Orca HCM - Improper Authentication
Priority MEDIUM 50CWE-1390Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00582 48th percentileScored 2026-11-07
Fix Fixed Orca HCM (Learning Digital): 11.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Learningdigital.com, Inc. | Orca HCM | before 11.0 | 11.0 | Patch available | CNA |
- Orca HCM VendorLearningdigital.com, Inc. Affected before 11.0 Fixed in 11.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:* | before 11.0 | Vulnerable | Learningdigital.com, Inc. |
- cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:* Versions before 11.0 Vulnerable ·Learningdigital.com, Inc.
Remediation
- Fix · CNA Orca HCM (Learning Digital) Fixed in 11.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Learning Digital Orca HCM 11.0
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2025-01193 Learning Digital Orca HCM - SQL InjectionPriority MEDIUM 41
- TI-2025-01192 Learning Digital Orca HCM - Arbitrary File UploadPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1387
- 2026-10-03 Alias added: GHSA-qppj-w5x7-cqx2
References
More Learningdigital.com, Inc. Orca Hcm vulnerabilities
- TI-2024-07960 LEARNING DIGITAL Orca HCM - Missing Authentication CVSS 3.1CRITICAL 9.8
- TI-2021-14418 Learningdigital.com, Inc. Orca HCM - Hard-code password CVSS 3.1CRITICAL 9.8
- TI-2021-14416 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
- TI-2021-14417 Learningdigital.com, Inc. Orca HCM - Broken Authentication CVSS 3.1CRITICAL 9.8
- TI-2025-01193 Learning Digital Orca HCM - SQL Injection CVSS 3.1HIGH 8.8
- TI-2025-01192 Learning Digital Orca HCM - Arbitrary File Upload CVSS 3.1HIGH 8.8
Sources
- CVE-2025-1387 · CVE Program
- CVE-2025-1387 · NVD
- FIRST EPSS
- GHSA-qppj-w5x7-cqx2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences