Is there a public PoC exploit available for EUVD-2026-38151?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38151. Prioritise patching immediately. EPSS: 0.2%.

ADP Application Developer Platform EUVD-2026-38151

Q: What is the CVSS score of EUVD-2026-38151?

EUVD-2026-38151 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-12787 LOW

Deserialization of Untrusted Data (CWE-502)

2026-06-21 VulDB

GHSA-wmfm-hrqf-22p6

Deserialization Adp Application Developer Platform

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network endpoint requires low-privilege auth (PR:L); no scope change confirmed; impact capped at Low (C/I/A:L) consistent with provided CVSS 4.0 assessment pending RCE confirmation.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 22, 2026 - 06:31 vuln.today

Severity Changed

Jun 21, 2026 - 09:22 NVD

MEDIUM LOW

CVSS changed

Jun 21, 2026 - 09:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0. This affects an unknown part of the component testConnection Endpoint. The manipulation of the argument jdbcUrl results in deserialization. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Unsafe deserialization in zhilink ADP Application Developer Platform 1.0.0 exposes the testConnection endpoint to remote exploitation by low-privilege authenticated users via manipulation of the jdbcUrl parameter. A public exploit has been published (linked via Feishu document) despite vendor non-response to coordinated disclosure. No public exploit identified at time of analysis meets the KEV threshold, but the combination of public PoC, network-accessible endpoint, and no patch raises operational risk - particularly for organizations running this Chinese low-code/RAD platform internally.

Technical ContextAI

The affected component is the testConnection endpoint of the ADP Application Developer Platform (应用开发者平台) version 1.0.0, developed by zhilink (智互联(深圳)科技有限公司), identified via CPE cpe:2.3:a:zhilink_智互联(深圳)科技有限公司:adp_application_developer_platform_应用开发者平台:*:*:*:*:*:*:*:*. The root cause is CWE-502: Deserialization of Untrusted Data. In this pattern, a jdbcUrl parameter - typically used to configure JDBC database connection strings - is passed to a deserialization routine without adequate type-checking, allowlisting, or integrity validation. Java JDBC URL handling can trigger class loading and object instantiation; when serialized payloads are embedded or referenced via the URL (e.g., using gadget chains against libraries on the classpath), arbitrary code execution or data access becomes possible depending on available deserialization gadgets. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N reflects a network-reachable endpoint with low attack complexity requiring only low-privilege authentication.

RemediationAI

No vendor-released patch identified at time of analysis - zhilink did not respond to coordinated disclosure. In the absence of an official fix, defenders should restrict access to the testConnection endpoint at the network or application layer, ensuring only trusted administrative roles can reach it; this directly addresses the PR:L attack surface by eliminating external low-privilege access to the endpoint. If the platform supports role-based endpoint access controls, disable or gate the testConnection functionality to administrator-only roles. Input validation on the jdbcUrl parameter - specifically blocking jdbc: URL schemes that can trigger external class loading (e.g., jdbc:jndi:, jdbc:sqlite:, or rogue JDBC driver URLs) - can reduce exploit viability as a compensating control, though this is harder to implement without source access. Monitor the VulDB entry at https://vuldb.com/vuln/372529 and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-12787 for vendor response or third-party patches. The public exploit is documented at https://ucn9h68n9289.feishu.cn/docx/I8uZdkZL3oSqBnxkwTAcfDvknUh.