Skip to content

Vendor

Dayforce vulnerabilities

3 published CVES affecting Dayforce, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
2
High
0
Medium
1
Low
0
Unscored
0
CISA KEV
0
Atom feed of Dayforce alerts

Products

Latest Dayforce CVEs

Newest publication first

  1. CVE-2026-73642 Path Traversal in Dayforce ESS Excelity

    Published
    CriticalCVSS 9.2 EPSS 0.42%

    Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.

  2. CVE-2026-73641 Multiple Reflected XSS in Dayforce ESS Excelity

    Published
    MediumCVSS 5.1 EPSS 0.33%

    Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

  3. CVE-2026-73640 Time-based SQL Injection in Dayforce ESS Excelity

    Published
    CriticalCVSS 9.3 EPSS 0.29%

    Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate r...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.