CVE-2025-1388 Learning Digital Orca HCM - Arbitrary File Upload
Remote attackers with regular privileges can upload and execute web shells in Orca HCM, leading to arbitrary code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1388?
CVE-2025-1388 is a high-severity vulnerability in Learning Digital Orca HCM, published on 17 Feb 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Orca HCM from LEARNING DIGITAL has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privileges to upload and run web shells
Weakness: CWE-434
Which versions are affected by CVE-2025-1388?
It affects 1 product.
Products include Learningdigital Orca Hcm.
How do I fix CVE-2025-1388?
No fix has been published for CVE-2025-1388 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-1388 being exploited?
There is no known exploitation of CVE-2025-1388 in the wild and no public exploit code.
Other vulnerabilities in Learning Digital Orca HCM
- CVE-2025-1387 Learning Digital Orca HCM - Improper Authentication
- CVE-2024-8584 LEARNING DIGITAL Orca HCM - Missing Authentication
- CVE-2021-35963 Learningdigital.com, Inc. Orca HCM - Unrestricted Upload of File with Dangerous Type
- CVE-2021-35965 Learningdigital.com, Inc. Orca HCM - Hard-code password
- CVE-2025-1389 Learning Digital Orca HCM - SQL Injection
Sources
Also known as GHSA-924w-gjwm-mghg.