EIP-2026-101675

This exploit demonstrates a persistent XSS vulnerability in Draytek VigorAP devices, where malicious script code can be injected into the username field of the RADIUS Server Configuration module. The PoC includes a payload that triggers an alert when the page is loaded.