CVE-2026-73642

Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. Because vendor contact attempts were unsuccessful, the vulnerability has only been...

CVE-2026-73641

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...

CVE-2026-73640

Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...

CVE-2026-73642 Path Traversal in Dayforce Payroll

Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. Because vendor contact attempts were unsuccessful, the vulnerability has only been...

CVE-2026-73642

The Dayforce Payroll software is vulnerable to a Path Traversal flaw within its file download functionality. An unauthenticated attacker can exploit this by sending a GET request with a manipulated file path parameter, potentially allowing access to any path, including absolute local file paths ....

EUVD-2026-88251

Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. Because vendor contact attempts were unsuccessful, the vulnerability has only been...

CVE-2026-73641 Multiple Reflected XSS in Dayforce Payroll

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...

EUVD-2026-88250

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed...

CVE-2026-73641

The Dayforce Payroll application is vulnerable to Reflected XSS across multiple endpoints. An attacker can craft a malicious URL that, when opened by a victim, leads to arbitrary JavaScript execution within the victim's browser. While the vulnerability is confirmed in version R2026.2.0 , it may a...

CVE-2026-73640

The Dayforce Payroll software is vulnerable to Time-Based Blind SQL Injection within its password recovery functionality . An unauthenticated attacker can exploit this by sending a GET request containing an arbitrary SQL query in one of the parameters. This parameter is incorrectly interpreted as...

CVE-2026-73640 Time-based SQL Injection in Dayforce Payroll

Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...

EUVD-2026-88249

Dayforce Payroll is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as part of SQL predicate resulting in Time-Based...