CVE-2020-25750

DotPlant2 contains an XXE vulnerability in Pay2PayPayment::checkResult() where user input from $_POST['xml'] is fed to simplexml_load_string without sanitization. Affected: DotPlant2 versions before 2020-09-14; note that maintenance status is archived. Impact described in sources: potential XML E...