Search
Search Results (7 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-71389 | 2 Cal, Calcom | 2 Cal.com, Cal.diy | 2026-07-28 | 10 Critical |
| Cal.com (calcom/cal.diy) before 5.9.9 is vulnerable to unauthenticated remote code execution because it bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request to the server and cause arbitrary code to be executed during server-side processing, without authentication or user interaction. The flaw derives from the upstream Next.js vulnerability CVE-2025-55182 and is resolved in 5.9.9 by updating the affected dependency. | ||||
| CVE-2024-58355 | 2 Cal, Calcom | 2 Cal.com, Cal.diy | 2026-07-28 | 8.9 High |
| Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16. | ||||
| CVE-2024-58353 | 2 Cal, Calcom | 2 Cal.com, Cal.diy | 2026-07-28 | 8.9 High |
| Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16. | ||||
| CVE-2026-23478 | 1 Cal | 1 Cal.com | 2026-04-18 | 9.8 Critical |
| Cal.com is open-source scheduling software. From 3.1.6 to before 6.0.7, there is a vulnerability in a custom NextAuth JWT callback that allows attackers to gain full authenticated access to any user's account by supplying a target email address via session.update(). This vulnerability is fixed in 6.0.7. | ||||
| CVE-2025-66489 | 1 Cal | 1 Cal.com | 2026-02-13 | 9.8 Critical |
| Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a TOTP code is provided, potentially gaining unauthorized access to user accounts. This issue exists due to problematic conditional logic in the authentication flow. This vulnerability is fixed in 5.9.8. | ||||
| CVE-2023-1647 | 1 Cal | 1 Cal.com | 2025-02-19 | 8.8 High |
| Improper Access Control in GitHub repository calcom/cal.com prior to 2.7. | ||||
| CVE-2023-37919 | 1 Cal | 1 Cal.com | 2024-11-21 | 6.5 Medium |
| Cal.com is open-source scheduling software. A vulnerability allows active sessions associated with an account to remain active even after enabling 2FA. When activating 2FA on a Cal.com account that is logged in on two or more devices, the account stays logged in on the other device(s) stays logged in without having to verify the account owner's identity. As of time of publication, no known patches or workarounds exist. | ||||
Page 1 of 1.