CVE-2021-35964

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attackers to execute the management function without logging in, access members’ information, modify and delete the courses in system, thus causing users fail to access the learning content.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285CWE-287

Affected software

VendorProductVersions
Learningdigital.com, Inc.Orca HCM>= unspecified, <= 10.0

References

Timeline

Published
Jul 19, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-359659.8The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webCVE-2021-359666.1The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be rediCVE-2021-359675.3The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the sCVE-2021-359684.3The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers caCVE-2021-359697.5Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-35975.9A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of serviCVE-2021-359707.5Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permiCVE-2021-359719.8Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft CVE-2021-359739.8NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthentCVE-2021-359755.3Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.77CVE-2021-359766.1The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-previeCVE-2021-359779.8An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response
CVE-2021-35964: Critical severity, CVSS 9.8 | Vulnix