Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Learning Digital Orca HCM 11.0 Clear all filters
TI-2025-01193 CVE-2025-1389 · GHSA-wgrq-g47w-vxvj

Learning Digital Orca HCM - SQL Injection

Priority MEDIUM 41

Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, and delete database contents.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00505 Published 2025-02-17 Fixed in 11.0 CWE-89
TI-2025-01192 CVE-2025-1388 · GHSA-924w-gjwm-mghg

Learning Digital Orca HCM - Arbitrary File Upload

Priority MEDIUM 41

Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00523 Published 2025-02-17 Fixed in 11.0 CWE-434
TI-2025-01191 CVE-2025-1387 · GHSA-qppj-w5x7-cqx2

Learning Digital Orca HCM - Improper Authentication

Priority MEDIUM 50

Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00582 Published 2025-02-17 Fixed in 11.0 CWE-1390