CVE-2025-60916 is a reflected cross-site scripting (XSS) vulnerability identified in the Openatlas software developed by the Austrian Archaeological Institute. The vulnerability exists in the /overview/network/ endpoint, specifically through the 'charge' parameter, which fails to properly sanitize user-supplied input. An attacker can craft a malicious payload that, when injected into this parameter, is reflected back in the HTTP response and executed within the victim's browser context. This allows the attacker to run arbitrary JavaScript code, potentially leading to session hijacking, credential theft, or unauthorized actions performed on behalf of the user. The vulnerability requires the attacker to have network access to the vulnerable endpoint and low privileges (PR:L), but does not require any user interaction (UI:N), increasing the risk of automated exploitation. The CVSS v3.1 base score is 5.4 (medium severity), reflecting limited confidentiality and integrity impact and no availability impact. No patches or exploit code are currently publicly available, and no known active exploitation has been reported. The vulnerability is classified under CWE-79, which covers improper neutralization of input leading to XSS. Given the specialized nature of Openatlas as an archaeological research tool, the attack surface is relatively narrow but significant for affected organizations.

For European organizations, particularly those involved in archaeological research, cultural heritage management, and academic institutions using Openatlas, this vulnerability could lead to unauthorized access to sensitive research data or user credentials. Exploitation could allow attackers to hijack user sessions, manipulate displayed data, or perform actions with the victim's privileges within the application. While the impact on availability is negligible, the compromise of confidentiality and integrity could undermine research integrity and data privacy. Since Openatlas is a niche product primarily used in European archaeological circles, the impact is geographically concentrated but critical for those affected. Additionally, successful exploitation could serve as a foothold for further attacks within the organization's network, especially if the compromised user has elevated privileges. The lack of user interaction requirement increases the risk of automated attacks targeting vulnerable endpoints.

Organizations should immediately upgrade Openatlas to version 8.12.0 or later, where this vulnerability is addressed. In the absence of an available patch, implement strict input validation and output encoding on the 'charge' parameter to neutralize malicious scripts. Employ Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts in the browser context. Regularly audit web application logs for suspicious requests targeting the /overview/network/ endpoint. Limit access to the Openatlas web interface through network segmentation and firewall rules to reduce exposure. Educate users about the risks of XSS and encourage the use of modern browsers with built-in XSS protection features. Finally, monitor threat intelligence feeds for any emerging exploit code or attack campaigns targeting this vulnerability.