This vulnerability affects version 1.0.0 of the ADP Application Developer Platform by zhilink 智互联(深圳)科技有限公司. The issue arises from improper handling of XML external entity references in the XML parser component at the /adpweb/a/base/barcodeDetail/import path. This allows remote attackers to initiate XXE attacks. The vulnerability has been publicly disclosed, but no official remediation or patch has been provided by the vendor. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low complexity, no user interaction, and limited confidentiality, integrity, and availability impacts.

The vulnerability enables remote attackers to exploit XML external entity references, potentially leading to information disclosure or other impacts related to XXE attacks. The CVSS score of 5.3 reflects a medium severity with limited impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or provided a fix, users should consider implementing XML parser configurations that disable external entity processing as a temporary mitigation until an official patch is available.