DotPlant2 Improper Restriction of XML External Entity Reference

HIGH 7.5CVE-2020-25750 · GHSA-c49v-35ff-q9f7 · Published 18/09/2020 · updated 17/06/2026

In short

CVE-2020-25750 is a HIGH (CVSS 7.5) vulnerability affecting devgroup/dotplant, dotplant2 (dotplant).
Chance of exploitation in the next 30 days (EPSS): 1.1%, higher than 66.9% of all vulnerabilities.
Fix: update to 2020-09-14 or later.

Package	Affected versions	Patched versions
devgroup/dotplant Packagist	`< 2020-09-14`	`2020-09-14`
dotplant2 dotplant	`< 2020-09-14`	`2020-09-14`

Description

An issue was discovered in DotPlant2 before 2020-09-14. In class Pay2PayPayment in payment/Pay2PayPayment.php, there is an XXE vulnerability in the checkResult function. The user input ($_POST['xml']) is used for simplexml_load_string without sanitization. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2020-25750 · ADVISORY
DevGroup-ru/dotplant2 · WEB
DevGroup-ru/dotplant2 commit fee86c7 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free