The vulnerability CVE-2025-60246 affects the Simple Finance Calculator by weissmike, allowing reflected cross-site scripting due to improper input neutralization in web page generation. This enables attackers to inject malicious scripts that execute when a user interacts with crafted input, potentially leading to information disclosure, modification, or disruption of service. The CVSS v3.1 base score is 7.1, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of the victim's browser session. This may result in limited confidentiality breaches (e.g., theft of session tokens), integrity issues (e.g., manipulation of displayed data), and availability impacts (e.g., disruption of service). There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted input in the affected application. Consider implementing input validation and output encoding as temporary mitigations if possible.