Dayforce vulnerabilities
We track 2 vulnerabilities in Dayforce products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
2vulnerabilities
2critical
0high
0exploited
9.3average CVSS score
Latest Dayforce vulnerabilities
- 9.2 Critical severity
ESS Excelity: Improper Limitation of a Pathname to a Restricted Directory
Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. This issue was fixed in version V4.
- 9.3 Critical severity
ESS Excelity: Improper Neutralization of Special Elements used in an SQL Command
Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can prepare GET request with one of the parameters filled in with an arbitrary SQL query. The parameter is interpreted as par