{"id":"CVE-2021-35968","aliases":["EUVD-2021-22601","GHSA-79hp-68x4-58hx"],"status":"published","title":"Learningdigital.com, Inc. Orca HCM - Path Traversal-2","description":"The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01035,"percentile":0.64162,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2021-07-19T11:55:47Z","modified":"2026-06-17T03:58:07Z","products":[{"vendor":"learning digital","product":"orca hcm"},{"vendor":"learningdigital","product":"orca_hcm"},{"vendor":"learningdigital.com, inc.","product":"orca hcm"}],"references":[{"url":"https://www.chtsecurity.com/news/ba7b3ae7-14f3-4970-b3f6-4d97d8c7ea25","tags":["x_refsource_MISC","x_transferred","Not Applicable"]},{"url":"https://www.twcert.org.tw/tw/cp-132-4928-7e87b-1.html","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-35968"},{"url":"https://github.com/advisories/GHSA-79hp-68x4-58hx"}],"sources":{"cve":[{"id":"CVE-2021-35968","title":"Learningdigital.com, Inc. Orca HCM - Path Traversal-2","description":"The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.","status":"published","published":"2021-07-19T11:55:47.851Z","modified":"2024-09-17T01:01:11.96Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:33:09.864034Z"}],"euvd":[{"id":"EUVD-2021-22601","description":"The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.","status":"published","published":"2021-07-19T11:55:47Z","modified":"2024-09-17T01:01:11Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:28:53.686001Z"}],"ghsa":[{"id":"GHSA-79hp-68x4-58hx","title":"The directory list page parameter of the Orca HCM digital learning platform fails to filter...","description":"The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.","status":"published","published":"2022-05-24T22:28:22Z","modified":"2023-01-30T05:05:17Z","cwes":["CWE-22"],"updated_at":"2026-11-02T14:47:14.398767Z"}],"nvd":[{"id":"CVE-2021-35968","description":"The directory list page parameter of the Orca HCM digital learning platform fails to filter special characters properly. Remote attackers can access the system directory thru Path Traversal with users’ privileges.","status":"published","published":"2021-07-19T12:15:08.727Z","modified":"2026-06-17T03:58:07.437Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:06:55.747384Z"}]}}