CVE-2021-35965

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-522CWE-1188

Affected software

No affected versions have been published.

Timeline

Published
Jul 19, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-359666.1The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be rediCVE-2021-359675.3The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can access the sCVE-2021-359684.3The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers caCVE-2021-359697.5Pexip Infinity before 26 allows temporary remote Denial of Service (abort) because of missing call-setup input validation.CVE-2021-35975.9A flaw was found in undertow. The HTTP2SourceChannel fails to write the final frame under some circumstances, resulting in a denial of serviCVE-2021-359707.5Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permiCVE-2021-359719.8Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft CVE-2021-359739.8NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthentCVE-2021-359755.3Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.77CVE-2021-359766.1The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-previeCVE-2021-359779.8An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response CVE-2021-359789.8An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER pr
CVE-2021-35965: Critical severity, CVSS 9.8 | Vulnix