Threat database

3 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published
Critical	9.2	EPSS 0.4%	CVE-2026-73642ESS Excelity · Path Traversal Critical9.2EPSS 0.4%2026-09-28CVE Database V5CVE-2026-73642 Dayforce ESS Excelity contains a critical path traversal vulnerability (CWE-22) in its file download functionality. An unauthenticated attacker can exploit this flaw by sending a crafted GET request with a file path parameter that references arbitrary local files. This vulnerability allows unauthorized access to restricted files on the server. The issue has been fixed in version 4 of the product. EPSS 0.4%Vulnerability Dayforce #cwe-22	CVE Database V5	2026-09-28
Medium	5.1	EPSS 0.3%	CVE-2026-73641ESS Excelity · Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') Medium5.1EPSS 0.3%2026-09-28CVE Database V5CVE-2026-73641 Dayforce ESS Excelity contains a reflected cross-site scripting (XSS) vulnerability in multiple endpoints. This allows an attacker to craft a malicious URL that executes arbitrary JavaScript in a victim's browser when opened. The vulnerability is fixed in version 4. EPSS 0.3%Vulnerability Dayforce #cwe-79	CVE Database V5	2026-09-28
Critical	9.3	EPSS 0.3%	CVE-2026-73640ESS Excelity · SQL injection Critical9.3EPSS 0.3%2026-09-28CVE Database V5CVE-2026-73640 Dayforce ESS Excelity has a critical SQL injection vulnerability (CVE-2026-73640) in its password recovery functionality. An unauthenticated attacker can exploit a parameter in a GET request to perform time-based blind SQL injection. This vulnerability allows attackers to execute arbitrary SQL queries via the vulnerable parameter. The issue was fixed in version 3 of the product. EPSS 0.3%Vulnerability Dayforce #cwe-89	CVE Database V5	2026-09-28

Showing 1–3 of 3 results