CVE-2025-60197

Name of the Vulnerable Software and Affected Versions Simple Contact Forms versions prior to 1.6.5

Description Simple Contact Forms contains a Local File Inclusion issue, which occurs when an application includes a file without properly validating the input. This allows unauthenticated attackers to include and execute arbitrary files on the server, potentially leading to the execution of PHP code. This flaw can be exploited to bypass access controls or obtain sensitive data, particularly if images or other safe file types can be uploaded and subsequently included.

Recommendations Update Simple Contact Forms to a version newer than 1.6.4.