EIP-2026-112687

The exploit demonstrates a command injection vulnerability in Time and Expense Management System (TEMS) via a crafted multipart/form-data request to BackupData.php, allowing arbitrary command execution (e.g., launching calc.exe). It also includes a separate PoC for arbitrary file upload via Edit.php, enabling PHP shell deployment.