Design/Logic Flaw

MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter...