MailEnable prior to 8.60 allows XXE via an XML document in the request.aspx Options parameter.
mailenable mailenable