Logo
Retour à la veille

CVE-2024-58353

Publié : 23 juillet 2026
Modifié : 23 juillet 2026
Lien officiel NVD
Score CVSS
8.9
HIGH

Description détaillée

Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L

Références et Patchs

https://github.com/calcom/cal.diy/commit/00689fda0a30b8f933c096f02c1fe092a4206defhttps://github.com/calcom/cal.diy/security/advisories/GHSA-vgj7-76cw-h6f8https://www.vulncheck.com/advisories/cal-com-through-cross-site-scripting-via-booking-questions

Dernières Vulnérabilités

CVE-2026-50044

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or a pass-the-hash attack.

VOIR DÉTAILS

CVE-2026-44955

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery by unauthenticated users.

VOIR DÉTAILS

CVE-2026-42933

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would bypass OT segmentation.

VOIR DÉTAILS