by Kastro
Paper/Archive/CVE-2025-1387

CVE-2025-1387

Learning Digital Orca HCM — Learning Digital Orca HCM - Improper Authentication

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 47.8.478 × 209.6No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Orca HCM from LEARNING DIGITAL has an Improper Authentication vulnerability, allowing unauthenticated remote attackers to log in to the system as any user.

Affected

ProductAffectedFixed inSource
Orca HCM< 11.011.0CNA

Scores by source

twcert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeuptwcert.org.tw/tw/cp-132-8427-daea8-1.htmlwriteuptwcert.org.tw/en/cp-139-8428-59a9a-2.html