Cal Com Self Hosted Cal Diy
Monthly
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.