CVE-2024-58355

HighCVSS 8.9/10Last modified Jul 30, 2026

Description

Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.

Metrics

CVSS 3.1 8.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Jul 23, 2026
Last modified: Jul 30, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-583566.3SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined wi CVE-2024-583576.5SurrealDB versions before 2.1.0 contain an uncaught exception vulnerability in the rand::time() function that panics when unwrap is called o CVE-2024-583584.9SurrealDB versions before 2.1.0 contain a denial of service vulnerability in role conversion that allows privileged owner users to define us CVE-2024-583596.5SurrealDB versions before 2.1.0 contain a denial of service vulnerability in the sorting mechanism when using ORDER BY rand() clause. Author CVE-2024-58368.8Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who convinced a user to install a malic CVE-2024-583606.5stoatchat versions before 0.7.8 fail to enforce account creation restrictions including invite-only mode, email verification, captcha, and s CVE-2024-583616.5SurrealDB versions before 2.0.4 contain an uncaught exception handling vulnerability in the parser error rendering code when processing empt CVE-2024-583628.8SurrealDB before 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) accepts an arbitrary object in the signin and signup operations of the RPC API w CVE-2024-583636.3SurrealDB before 1.5.4 fails to properly validate authentication when a scope user switches databases using the USE clause or use method. At CVE-2024-583646.5SurrealDB versions before 1.2.1 contain an uncaught exception handling vulnerability in span rendering when parsing queries with errors on l CVE-2024-583656.5SurrealDB versions before 1.2.0 contain an uncaught exception vulnerability in the query executor when processing calls to nonexistent built CVE-2024-583668.8SurrealDB before 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Atta