{"id":"GHSA-c49v-35ff-q9f7","aliases":["CVE-2020-25750"],"title":"DotPlant2 Improper Restriction of XML External Entity Reference","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.","severity":"high","score":7.5,"published":"2022-05-24T17:29:01.000Z","modified":"2024-04-22T19:41:55.295Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"devgroup/dotplant","sources":[{"name":"OSV · GHSA-c49v-35ff-q9f7","url":"https://osv.dev/vulnerability/GHSA-c49v-35ff-q9f7"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"2020-09-14"}],"type":"ECOSYSTEM"}],"versions":["0.0.1","0.0.2","0.0.3","0.0.4","1.0.0"],"fixed":["2020-09-14"]}],"sourceAffected":[],"references":["https://nvd.nist.gov/vuln/detail/CVE-2020-25750","https://github.com/DevGroup-ru/dotplant2/issues/400","https://github.com/DevGroup-ru/dotplant2/commit/fee86c7052c227762c7325eb5c2811d9323f8429"],"sources":[{"name":"OSV","id":"GHSA-c49v-35ff-q9f7","modified":"2024-04-22T19:41:55.295535Z","url":"https://osv.dev/vulnerability/GHSA-c49v-35ff-q9f7"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}],"products":[],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-28T11:50:31.287Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}