{"affected":[{"product":"PrestaShop","source":"CNA: certcc","vendor":"PrestaShop","versions":[{"lessThan":"9.2.1","status":"affected","version":"1.5.0.0","versionType":"custom"}]}],"cveId":"CVE-2026-124916","cwes":["CWE-94","CWE-79"],"description":"PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":5.4,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794238466281,"publishedAt":1794236001309,"references":[{"source":"CNA: certcc","tags":[],"url":"https://prestashop.com/"},{"source":"CNA: certcc","tags":[],"url":"https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q"}],"remediation":[],"revision":"8c3ef4a3947162d4f156fc437f742a76f7cfcef794c554e970b896b32161d240","sources":[{"modifiedAt":1794238466281,"name":"CNA: certcc","retrievedAt":1794240622693,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124916"}],"ssvc":{"assessedAt":1794238424023,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"total"},"status":"published","title":"PrestaShop Performance Debug Configuration PHP Code Injection","updatedAt":1794240622693}