CVE-2021-35964 Learningdigital.com, Inc. Orca HCM - Broken Authentication
Remote attackers can access the management page without authentication to view member data and modify or delete courses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-35964?
CVE-2021-35964 is a high-severity missing authorization vulnerability in Learningdigital.com, Inc. Orca HCM, published on 19 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.
Which versions are affected by CVE-2021-35964?
It affects 1 product.
Products include Learningdigital Orca Hcm.
How do I fix CVE-2021-35964?
No fix has been published for CVE-2021-35964 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-35964 being exploited?
There is no known exploitation of CVE-2021-35964 in the wild and no public exploit code.
Other vulnerabilities in Learningdigital.com, Inc. Orca HCM
- CVE-2025-1387 Learning Digital Orca HCM - Improper Authentication
- CVE-2024-8584 LEARNING DIGITAL Orca HCM - Missing Authentication
- CVE-2021-35963 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type
- CVE-2021-35965 Learningdigital.com, Inc. Orca HCM - Hard-code password
- CVE-2025-1388 Learning Digital Orca HCM - Arbitrary File Upload
Sources
Also known as GHSA-84xp-phcj-753r.