CVE-2024-58355

· HIGHDeferred

← All CVEs

CVSS v3.1

8.9

CVSS v4.0

9.3

EPSS

0.29%

Published

Jul 23, 2026

Modified

Jul 30, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-80

References (4)

https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def

https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8

https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions-2

https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8

KEV Catalog EPSS Scores Vendors All CVEs