ASUS Download Master - Stored XSS

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://www.twcert.org.tw/en/cp-139-7864-d7a0d-2.html
• https://localh0st.run/post/asus-downloadmaster-1/
• https://www.twcert.org.tw/tw/cp-132-7863-49a2d-1.html
• https://www.cve.org/CVERecord?id=CVE-2024-31160
• https://stack.watch/product/asus/
• https://www.asus.com/security-advisory/
• https://www.bleepingcomputer.com/news/security/asus-warns-of-critical-remote-authentication-bypass-on-7-routers/

Related Vulnerabilities

• PoCCVE-2026-81199: MasterStudy LMS < 3.7.46 - Unauthenticated Student Statistics Disclosure
• 上海小羚羊软件股份有限公司小羚羊ERP系统downloadView存在任意文件读取漏洞
• 仁和兴业（深圳）软件有限公司仁和云ERP attachmentdownloadAttachment 接口存在任意文件读取漏洞
• Hepta Platforms｜Heptabase - Stored Cross-Site Scripting
• PoCCVE-2026-1115: parisneo/lollms < 2.2.0 - Authenticated Stored XSS
• 玉帛软件仓库管理系统DownloadFile存在任意文件读取漏洞
• 安科瑞EMS企业微电网能效管理平台 /SubstationWEBV2/main/appDownload 文件读取漏洞
• 云连ERP管理系统 /gateway/download!download.action 代码执行漏洞
• 泛微 e-cology10 /papi/em/transform/downLoadSyslog 文件读取漏洞
• PoCCVE-2026-8037: Progress ADC LoadMaster - Command Injection
• 方向标邮件网关 /common/cgi/download.cgi 代码执行漏洞
• MasterStudy LMS /wp-admin/admin-ajax.php?action=stm_lms_load_content 文件包含漏洞（CVE-2024-3136）
• Progress Kemp LoadMaster /accessv2 命令执行漏洞（CVE-2026-8037）