CVE-2024-58355

Cal.com calcom/cal.diy versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view e.g., https://app.cal.com/booking/ renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can...

CVE-2024-58353: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Cal.com repository calcom/cal.diy in versions = 4.7.15 is vulnerable to cross-site scripting XSS on the publicly accessible single booking view e.g., /booking/ . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an...