discount: reference directly the reproducing file to better identify the CVEs

Since the reporter did fill all the issues in one upstream issue
directly reference the pocs as well to make it clear which CVE is for
which issue.