Back to CVE Browser

CVE-2021-35966

MEDIUM

6.1

CVSS Severity Score

EPSS Score0.0260%

EPSS Percentile40.89th

PublishedJul 19, 2021

Last ModifiedNov 21, 2024

Vulnerability Description

The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks.

Affected Platforms (CPE)

📦

Learningdigital

Orca Hcm

<= 10.0

References & Advisories

🔗 https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25

🔗 https://www.twcert.org.tw/tw/cp-132-4926-dc06b-1.html

🔗 https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25

🔗 https://www.twcert.org.tw/tw/cp-132-4926-dc06b-1.html

Related Vulnerabilities

CVE-2021-359639.8

The specific parameter of upload function of the Orca HCM digital learning platform does not filter file format, which allows remo...

CVE-2021-359659.8

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code ...

CVE-2021-359647.3

The management page of the Orca HCM digital learning platform does not perform identity verification, which allows remote attacker...

CVE-2021-359675.3

The directory page parameter of the Orca HCM digital learning platform does not filter special characters. Remote attackers can ac...