{"id":"CVE-2026-124916","published":"2026-11-09T15:17:19.227","lastModified":"2026-11-09T17:17:27.847","description":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.","cvssScore":5.4,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","tags":[]},{"url":"https://prestashop.com/","tags":[]},{"url":"https://www.kb.cert.org/vuls/id/385711","tags":[]}],"exploitRefs":[{"url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q","tags":[]}],"hasPoc":true,"ai":null}