{"id":"CVE-2020-25750","aliases":["EUVD-2022-3500","GHSA-c49v-35ff-q9f7"],"status":"published","title":"DotPlant2 Improper Restriction of XML External Entity Reference","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.01145,"percentile":0.67208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-611"],"published":"2020-09-18T03:25:50Z","modified":"2026-06-17T03:07:14Z","fixes":[{"ecosystem":"Packagist","package":"devgroup/dotplant","fixed_in":["2020-09-14"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"devgroup/dotplant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020-09-14"}]}]},{"source":"osv","ecosystem":"Packagist","package":"devgroup/dotplant","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2020-09-14"}]}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","1.0.0"]}],"products":[{"vendor":"dotplant","product":"dotplant2"}],"references":[{"url":"https://github.com/DevGroup-ru/dotplant2/issues/400","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25750","tags":["advisory"]},{"url":"https://github.com/DevGroup-ru/dotplant2/commit/fee86c7052c227762c7325eb5c2811d9323f8429","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c49v-35ff-q9f7"}],"sources":{"cve":[{"id":"CVE-2020-25750","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer","status":"published","published":"2020-09-18T03:25:50Z","modified":"2024-08-04T15:40:36.894Z","updated_at":"2026-11-02T14:35:48.854892Z"}],"euvd":[{"id":"EUVD-2022-3500","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer","status":"published","published":"2020-09-18T03:25:50Z","modified":"2024-08-04T15:40:36Z","updated_at":"2026-11-03T03:07:16.308974Z"}],"ghsa":[{"id":"GHSA-c49v-35ff-q9f7","title":"DotPlant2 Improper Restriction of XML External Entity Reference","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-05-24T17:29:01Z","modified":"2024-04-22T19:00:51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:37:44.335614Z"}],"nvd":[{"id":"CVE-2020-25750","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer","status":"published","published":"2020-09-18T04:15:12.127Z","modified":"2026-06-17T03:07:14.337Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:06:15.83396Z"}],"osv":[{"id":"GHSA-c49v-35ff-q9f7","title":"DotPlant2 Improper Restriction of XML External Entity Reference","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","status":"published","published":"2022-05-24T17:29:01Z","modified":"2024-04-22T19:41:55.295535Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:44.571161Z"}]}}