EIP-2026-100018

This PHP script exploits an XXE (XML External Entity) injection vulnerability in Plesk SSO (Single Sign-On) to read arbitrary files or execute commands via the 'expect://' wrapper. It crafts a malicious SAML request with an embedded XXE payload and sends it to the target Plesk instance.