Product
Cal.com Cal.diy versions 2.1.1 through 6.2.0 contain a stored XSS vulnerability allowing authenticated event owners to inject malicious JavaScript into public booking pages.