CVE-2024-58355

Cal.com (calcom/cal.diy) versions up to 4.7.15 are affected by a stored XSS in the booking flow. The vulnerability occurs in the single booking view where booking-question labels are rendered via React’s dangerouslySetInnerHTML without sanitization, allowing an attacker who can create an event ty...