This vulnerability affects version 1.0.0 of the ADP Application Developer Platform by zhilink 智互联(深圳)科技有限公司. It arises from improper handling of XML external entity references in the XML parser component at the specified import endpoint. This flaw allows remote attackers to initiate an XXE attack, potentially leading to information disclosure or other impacts associated with XXE. The vendor was contacted but did not provide any response or remediation. No official fix or patch is currently known or available.

The vulnerability enables remote attackers to exploit XML external entity references, which can lead to partial information disclosure or other impacts typical of XXE vulnerabilities. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, and limited confidentiality, integrity, and availability impacts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch or workaround is available, users should consider disabling or restricting XML external entity processing in the affected component if possible, or apply network-level protections to limit access to the vulnerable endpoint until an official fix is released.