CVE-2026-124916

PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.

• CWE-79

• https://github.com/PrestaShop/PrestaShop/security/advisories/GHSA-95f5-jc9c-gg3q
• https://prestashop.com/
• https://www.kb.cert.org/vuls/id/385711

Published

Nov 9, 2026

Last Modified

Nov 9, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12486Multiple OS command injection vulnerabilities exist in the l…9.1
• CVE-2026-12488A memory corruption vulnerability exists in the GV-Cloud fun…6.2
• CVE-2026-12489An incorrect authorization vulnerability in the Data Access …6.5
• CVE-2026-1249The MP3 Audio Player – Music Player, Podcast Player & Radio …5
• CVE-2026-12490When a provide-xfr is given with a tls-auth-name, a secondar…7.5
• CVE-2026-12491A flaw was found in vLLM, an open-source library for large l…4.8
• CVE-2026-12492The Happy Coders OTP Login for WooCommerce WordPress plugin …9.8
• CVE-2026-12493The Clover Payment Gateway by Zaytech for WooCommerce WordPr…7.5
• CVE-2026-12495Denial-of-service (DoS) vulnerability due to a stack buffer …5.3
• CVE-2026-124959The loadIndex function in nmslib hnswlib and Spotify Voyager…
• CVE-2026-12496Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA serve…8.7
• CVE-2026-12497The Paid Membership Plugin, Ecommerce, User Registration For…7.5