Loading story…
CERT Polska disclosed three vulnerabilities in Dayforce Payroll version R2026.2.0: an unauthenticated time-based blind SQL injection in password recovery (CVE-2026-73640), reflected cross-site scripting affecting multiple endpoints (CVE-2026-73641), and an unauthenticated path-traversal flaw in file-download functionality (CVE-2026-73642). The flaws could enable unauthorized database inference, script execution in users’ browsers, and access to files outside intended download paths.
The issues were reported by researcher Dawid Dudek, known as 4c1d8urn, and disclosure was coordinated by CERT Polska. CERT Polska said it was unable to establish contact with the vendor, so testing and confirmation were limited to R2026.2.0; other Dayforce Payroll releases may also be affected. Organizations using the product should identify exposed instances, restrict public access where feasible, monitor password-recovery and download endpoints for anomalous requests, and seek vendor remediation or compensating controls.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
CERT Polska published advisories for CVE-2026-73640, CVE-2026-73641, and CVE-2026-73642, confirmed in Dayforce Payroll R2026.2.0. The flaws comprise unauthenticated time-based blind SQL injection in password recovery, reflected XSS across multiple endpoints, and unauthenticated path traversal in file downloads; CERT Polska said vendor contact attempts were unsuccessful.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
MITRE has published two high-severity SQL injection vulnerabilities affecting widely available PHP-based management applications: **SourceCodester Payroll Management and Information System v1.0** and **CodeAstro Simple Attendance Management System v1.0**. The SourceCodester issue, tracked as `CVE-2026-37347`, affects `/payroll/view_employee.php` and is classified as `CWE-89`; its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N` indicates remote exploitation with no privileges or user interaction required, with high impact to confidentiality and integrity. The CodeAstro flaw, `CVE-2026-37749`, is also a `CWE-89` SQL injection bug and affects `index.php`, where the `username` parameter can be abused by remote, unauthenticated attackers to bypass authentication. Its CVSS v3.1 vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H` reflects high impact across confidentiality, integrity, and availability. Both CVE entries were updated with severity details and public references, including GitHub documentation, underscoring the exposure of internet-reachable administrative and employee-management functions to straightforward injection attacks.
Jun 29, 2026
dCERT issued advisory `2026-0776` for **Netwrix Password Secure**, warning of multiple vulnerabilities in the password management product. The notice indicates that several security flaws affect the software, creating potential risk for organizations that rely on it to store and manage privileged or sensitive credentials. A separate dCERT advisory, `2025-2738`, also reported multiple **Linux kernel** vulnerabilities that could allow **denial-of-service** conditions. Together, the advisories highlight concurrent exposure in both enterprise credential-management software and core operating system components, underscoring the need for defenders to review vendor guidance, assess affected deployments, and prioritize patching or other mitigations.
Jun 29, 2026
CERT Polska disclosed three vulnerabilities in **JCD Windu CMS** affecting confirmed version **4.1**, warning that other versions may also be impacted. The issues include **CVE-2026-57309**, a blind SQL injection mapped to **`CWE-89`** that can be exploited remotely without authentication by injecting SQL syntax into a URL path carried in an HTTP header, and **CVE-2026-57310**, a password storage weakness mapped to **`CWE-916`** caused by the use of **MD5** and **SHA1** with a static salt. The advisory also details **CVE-2026-57311**, an unrestricted file upload flaw that allows an authenticated attacker to upload arbitrary files, including **PHP**, resulting in remote code execution. CERT Polska said it coordinated disclosure of the vulnerabilities and credited **Jakub Lipiński, Marek Tołczyk, and Kamil Królikowski** with the responsible report, underscoring the risk of database compromise, credential exposure, and server takeover in affected Windu CMS deployments.
Jul 20, 2026