Vulnerabilitates in software Dayforce Payroll
CVE ID
CVE-2026-73640
Publication date
28 Septembris 2026
Vendor
Dayforce
Product
Payroll
Vulnerable versions
R2026.2.0
Vulnerability type (CWE)
Improper neutralization of special elements used in an SQL command ('SQL injection') (CWE-89)
Report source
Report to CERT Polska
CVE ID
CVE-2026-73641
Publication date
28 Septembris 2026
Vendor
Dayforce
Product
Payroll
Vulnerable versions
R2026.2.0
Vulnerability type (CWE)
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (CWE-79)
Report source
Report to CERT Polska
CVE ID
CVE-2026-73642
Publication date
28 Septembris 2026
Vendor
Dayforce
Product
Payroll
Vulnerable versions
R2026.2.0
Vulnerability type (CWE)
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Report source
Report to CERT Polska
Description
CERT Polska reportum de vulnerabilitatibus in software Dayforce Payroll accepit et in coordinatione eorum divulgationis participavit.
Vulnerabilitas CVE-2026-73640: Dayforce Payroll vulnerabilis est ad Time Based-Blind SQL Injection in functionality recuperationis password. Impostor non authentificatus potest parare petitionem GET cum uno ex parametris impleto cum arbitraria SQL quaestione. Parametrus interpretatur ut pars praedicati SQL, quod ducit ad Time-Based Blind SQL Injection.
Vulnerabilitas CVE-2026-73641: Dayforce Payroll vulnerabilis est ad Reflected XSS in pluribus terminis. Impostor potest parare URL specialiter formatam, quae, cum aperitur, ducit ad arbitrariam JavaScript executionem in navigatro victimarum.
Vulnerabilitas CVE-2026-73642: Dayforce Payroll vulnerabilis est ad Path Traversal in functionality download file. Impostor non authentificatus potest mittere petitionem GET cum parametro viae file ad quemlibet locum includens absolutum locum file localem.
Quoniam conatus contactus venditoris non successerunt, vulnerabilitates tantum in versione R2026.2.0 confirmatae sunt, sed etiam alias versiones afficere possunt.
Credits
Gratias agimus Dawid Dudek (4c1d8urn) pro responsabili relatione vulnerabilitatis.
Plura de processu coordinationis divulgationis vulnerabilitatis apud CERT Polska inveniuntur ad https://cert.pl/en/cvd/.