CVE-2026-25512

This repository contains a functional SQL injection exploit for WordPress Quiz Maker (CVE-2025-10042), demonstrating time-based blind SQLi via crafted HTTP headers. The exploit includes data extraction capabilities for admin credentials and password hashes.

This is a functional exploit PoC for CVE-2026-25512, demonstrating authenticated remote command execution in Group-Office via command injection in the TNEF attachment handler endpoint. The script authenticates, injects a payload via the 'tmp_file' parameter, and verifies execution by retrieving a proof file from the response.

This repository contains a functional proof-of-concept exploit for CVE-2026-25512, a command injection vulnerability in Group-Office's TNEF handler. The exploit demonstrates remote code execution by injecting shell metacharacters into the `tmp_file` parameter, which is passed unsanitized to an `exec()` call.