Is there a public PoC exploit available for CVE-2026-12788?

Yes, a public proof-of-concept exploit is available for CVE-2026-12788. Prioritise patching immediately. EPSS: 0.2%.

zhilink ADP Platform CVE-2026-12788

Q: What is the CVSS score of CVE-2026-12788?

CVE-2026-12788 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-38152 LOW

Improper Restriction of XML External Entity Reference (CWE-611)

2026-06-21 VulDB

GHSA-x2fm-rmw7-73v2

XXE Adp Application Developer Platform

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable import endpoint with no complexity barriers; PR:L because authentication is confirmed required; S:U as subsequent-system impact is assessed absent; C/I/A:L reflecting limited but real file-read and SSRF potential.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:31 vuln.today

Severity Changed

Jun 21, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 09:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was determined in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This vulnerability affects unknown code of the file /adpweb/a/base/barcodeDetail/import of the component XML Parser. This manipulation causes xml external entity reference. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

XML External Entity (XXE) injection in zhilink ADP Application Developer Platform 1.0.0 enables authenticated remote attackers to manipulate the XML parser at the /adpweb/a/base/barcodeDetail/import endpoint, potentially exposing local files or facilitating server-side request forgery against internal infrastructure. The CVSS 4.0 vector (PR:L, E:P) confirms low-privilege exploitation with a publicly disclosed proof-of-concept published on Feishu. The vendor did not respond to pre-disclosure contact, leaving no official patch available at time of analysis.

Technical ContextAI

CWE-611 (Improper Restriction of XML External Entity Reference) describes a parser that processes externally supplied XML without disabling DOCTYPE declarations or external entity resolution. The vulnerable component is the XML parser backing the barcode import functionality at /adpweb/a/base/barcodeDetail/import within the zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台. The CPE string (cpe:2.3:a:zhilink_智互联(深圳)科技有限公司:adp_application_developer_platform_应用开发者平台:*:*:*:*:*:*:*:*) covers version 1.0.0 as confirmed by EUVD-2026-38152. Classic XXE payloads can reference file:// URIs for local file disclosure or http:// URIs to pivot to internal network resources the server can reach (SSRF). The CVSS 4.0 subsequent-system metrics (SC:N/SI:N/SA:N) indicate the reporter assessed no direct cross-system scope change, though SSRF pivoting is an inherent XXE side effect.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to pre-disclosure contact. As a primary compensating control, restrict authenticated access to the /adpweb/a/base/barcodeDetail/import endpoint via WAF rules or reverse-proxy ACLs, limiting it to only those user roles that legitimately require barcode import functionality - this reduces the exploitable attack surface without disabling the broader application. At the XML parser layer, if source access is available, configure the XML parser to disable DOCTYPE declarations and external entity resolution (e.g., setting FEATURE_SECURE_PROCESSING or equivalent parser flags to true); this directly eliminates the CWE-611 root cause but requires application-level access and redeployment. Additionally, apply network egress filtering on the server hosting the platform to block outbound connections to arbitrary internal RFC-1918 addresses and file URIs, mitigating SSRF pivoting risk inherent to XXE. Monitor VulDB advisory https://vuldb.com/vuln/372530 and the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-12788 for any future vendor patch release.