PT-2026-51206 · Zhilink 智互联(深圳)科技有限公司 · Adp Application Developer Platform 应用开发者平台

Bigbrother_Man · Published 2026-06-21 · Updated 2026-06-21 · CVE-2026-12788

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Zhilink ADP Application Developer Platform version 1.0.0

Description An XML External Entity (XXE) injection issue exists in the XML Parser component. This occurs when the application processes XML input containing references to external entities, which can be manipulated to cause the system to disclose internal files or interact with internal networks. The issue is located in the '/adpweb/a/base/barcodeDetail/import' endpoint and can be triggered remotely.

Recommendations As a temporary workaround, restrict access to the '/adpweb/a/base/barcodeDetail/import' endpoint to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XXE

Weakness Enumeration

CWE-610

CWE-611

Related Identifiers

CVE-2026-12788

Affected Products

Adp Application Developer Platform 应用开发者平台

References · 7

• 🔥 https://ucn9h68n9289.feishu.cn/docx/LeLOdhV6mo3clzxstxXcpFzbnjg?from=from_copylink · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-12788 · Security Note
• https://vuldb.com/cve/CVE-2026-12788 · Note
• https://twitter.com/VulmonFeeds/status/2068636571499196812 · Twitter Post
• https://vuldb.com/vuln/372530/cti · Note
• https://vuldb.com/vuln/372530 · Note
• https://vuldb.com/submit/835655 · Note