Learning Digital Orca HCM - Arbitrary File Upload
Priority MEDIUM 41CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00523 44th percentileScored 2026-11-07
Fix Fixed Orca HCM (Learning Digital): 11.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Learningdigital.com, Inc. | Orca HCM | before 11.0 | 11.0 | Patch available | CNA |
- Orca HCM VendorLearningdigital.com, Inc. Affected before 11.0 Fixed in 11.0 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:* | before 11.0 | Vulnerable | Learningdigital.com, Inc. |
- cpe:2.3:a:learningdigital:orca_hcm:*:*:*:*:*:*:*:* Versions before 11.0 Vulnerable ·Learningdigital.com, Inc.
Remediation
- Fix · CNA Orca HCM (Learning Digital) Fixed in 11.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Learning Digital Orca HCM 11.0
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2025-01191 Learning Digital Orca HCM - Improper AuthenticationPriority MEDIUM 50
- TI-2025-01193 Learning Digital Orca HCM - SQL InjectionPriority MEDIUM 41
Timeline
- 2026-10-02 Threatist record created from CVE-2025-1388
- 2026-10-03 Alias added: GHSA-924w-gjwm-mghg
References
More Learningdigital.com, Inc. Orca Hcm vulnerabilities
- TI-2025-01191 Learning Digital Orca HCM - Improper Authentication CVSS 3.1CRITICAL 9.8
- TI-2024-07960 LEARNING DIGITAL Orca HCM - Missing Authentication CVSS 3.1CRITICAL 9.8
- TI-2021-14418 Learningdigital.com, Inc. Orca HCM - Hard-code password CVSS 3.1CRITICAL 9.8
- TI-2021-14416 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
- TI-2021-14417 Learningdigital.com, Inc. Orca HCM - Broken Authentication CVSS 3.1CRITICAL 9.8
- TI-2025-01193 Learning Digital Orca HCM - SQL Injection CVSS 3.1HIGH 8.8
Sources
- CVE-2025-1388 · CVE Program
- CVE-2025-1388 · NVD
- FIRST EPSS
- GHSA-924w-gjwm-mghg · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences