Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-23 | 2 | Disclosure1General1 |
| 2026-07-24 | 1 | Disclosure1 |
CVE-2024-58355 Stored Cross-Site Scripting in http://Cal.com Versions Through 4.7.15 https://vulmon.com/vulnerabilitydetails?qid=CVE-2024-58355
Post summary
The entry announces a stored XSS flaw in Cal.com versions up to 4.7.15, providing minimal technical details but no evidence of exploitation or mitigation.
🚨*CVE* CVE-2024-58355 http://Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/
Post summary
The post discloses a stored XSS flaw in Cal.com’s booking view (v4.7.15 and earlier) and provides technical details about the vulnerability, but does not mention PoC, exploitation, or patch information.
CVE-2024-58355 http://Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>)… https://www.cve.org/CVERecord?id=CVE-2024-58355
Post summary
The post identifies a stored XSS vulnerability in Cal.com versions up to 4.7.15 (CVE-2024-58355) but provides no PoC, exploit, patch, or evidence of active exploitation.