Dayforce ESS Excelity is vulnerable to time-based blind SQL injection in the password-recovery functionality. An unauthenticated attacker can craft a GET request where one of the parameters contains an arbitrary SQL query; the parameter is treated as part of the SQL predicate, enabling the attacker to infer the result of injected conditions by measuring query execution time and gradually extract database contents. The vulnerability is identified as CWE-89 and could allow an adversary to read or tamper with sensitive payroll information, compromising data confidentiality and integrity.

The flaw has been confirmed in Dayforce ESS Excelity version V3 and may also affect earlier releases, as no specific affected versions beyond V3 have yet been documented. All installations that expose the password-recovery endpoint without proper input validation are potentially susceptible, regardless of organizational size or geographic location.

The issue carries a CVSS score of 9.3, indicating critical severity, while the EPSS score is below 1%, suggesting a very low but non-zero probability of exploitation. Attackers can exploit the flaw remotely by sending a crafted GET request to the password-recovery endpoint, without needing prior authentication. Given the high severity rating and the straightforward nature of the exploit, systems that remain unpatched face a significant risk of data disclosure or manipulation, and automated scanners could trigger the attack surface without additional effort. The vulnerability is not listed in CISA’s KEV catalog.