CVE-2024-58355

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.

• CWE-80

• https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206def
• https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8
• https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions-2
• https://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8

Published

Jul 23, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-5835Heap buffer overflow in Tab Groups in Google Chrome prior to…8.8
• CVE-2024-58350Ghidra before 11.2 contains a use after free vulnerability i…4
• CVE-2024-58351Flowise before 2.1.4 allows configuration to be injected int…9.8
• CVE-2024-58352Landray OA contains an unauthenticated HQL injection vulnera…8.7
• CVE-2024-58353Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is…9.3
• CVE-2024-58354cal.com (calcom repository, later renamed cal.diy) is affect…9.9
• CVE-2024-58356SurrealDB before 2.1.4 silently fails to overwrite table def…6.3
• CVE-2024-58357SurrealDB versions before 2.1.0 contain an uncaught exceptio…7.1
• CVE-2024-58358SurrealDB versions before 2.1.0 contain a denial of service …6.9
• CVE-2024-58359SurrealDB versions before 2.1.0 contain a denial of service …7.1
• CVE-2024-5836Inappropriate Implementation in DevTools in Google Chrome pr…8.8
• CVE-2024-58360stoatchat versions before 0.7.8 fail to enforce account crea…6.9