rootpwn

medium · CVSS v3 6.1 · CVSS v4 5.1

CVE-2026-73641

Dayforce Payroll is affected by a reflected XSS vulnerability that allows arbitrary JavaScript execution via crafted URLs. The flaw exists i

Overview

Dayforce Payroll is affected by a reflected XSS vulnerability that allows arbitrary JavaScript execution via crafted URLs. The flaw exists in version R2026.2.0 and may affect other releases. It can be exploited by attackers to steal session data or perform malicious actions in the victim's browser.

Description

Dayforce Payroll is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version R2026.2.0 but may also affect other versions.

Impact

Confidentiality: attackers can steal sensitive payroll data by injecting scripts that capture form inputs. Integrity: malicious scripts could modify displayed data or submit fraudulent entries. Availability: not directly impacted. Defenders: end-users, administrators, and the payroll system.

Remediation

Apply the vendor's security patch for R2026.2.0 once released. Until then, restrict URL access to trusted users, enable input validation, and enforce a Content Security Policy (CSP) to block inline scripts. Disable or sanitize the affected endpoints if possible.

Risk context

The vulnerability is rated medium (CVSS 6.1) and currently has no EPSS score. While it does not pose an immediate widespread risk, attackers can exploit it via phishing or malicious links, so timely patching is advisable.

Affected products

  • Dayforce Payroll R2026.2.0
  • Dayforce Payroll
  • Dayforce Payroll R2026.1.0

Scores

Severity
medium
CVSS v2
4.3
CVSS v3
6.1
CVSS v4
5.1
EPSS
—

XSS Reflected XSS Dayforce Payroll Browser Exploit Medium Severity Input Validation

← All CVEs

Related CVEs

medium

CVE-2026-82546

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows an unauthenticated remote attacker to store a crafted comment-author URL through the incoming Trackback endpoint when a published entry accepts comments and Trackbacks. The shipped Trackback, verification and moderation defaults allow the value to be approved and rendered as an active link; a visitor who clicks the link executes script in the weblog's origin. Users are recommended to upgrade to Apache Roller 6.1.6 or later, which removes incoming Trackback support and suppresses non-HTTP(S) comment-author links. Users unable to upgrade should disable Trackbacks and remove untrusted Trackback comments.

View analysis

medium

CVE-2026-101035

A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Executing a manipulation can lead to uncaught exception. The attack can be launched remotely. The exploit has been published and may be used. This patch is called 1ae9bf2062b57595dbcbc4bc1d0a0ccf06815bac. It is best practice to apply a patch to resolve this issue.

View analysis

medium

CVE-2026-84744

The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them back into the rendered form, allowing unauthenticated users to execute arbitrary shortcodes registered on the site and read the details of attachments belonging to non-public posts.

View analysis

medium

CVE-2026-86838

The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appointment total, allowing unauthenticated users to reduce the total to zero and book paid services for free while bypassing the payment step.

View analysis