CVE-2021-35966

MEDIUM

Orca HCM < 10.0 - Open Redirect via Unfiltered Input Parameter

Title source: llm
STIX 2.1

Description

The specific function of the Orca HCM digital learning platform does not filter input parameters properly, which causing the URL can be redirected to any website. Remote attackers can use the vulnerability to execute phishing attacks.

References (2)

Core 2
Core References
Third Party Advisory x_refsource_misc
https://www.twcert.org.tw/tw/cp-132-4926-dc06b-1.html

Scores

CVSS v3 6.1
EPSS 0.0082
EPSS Percentile 52.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Details

CWE
CWE-601
Status published
Products (1)
learningdigital/orca_hcm < 10.0
Published Jul 19, 2021
Tracked Since Feb 18, 2026