CVE-2026-124916: fallo de gravedad media en PrestaShop
PrestaShop Performance Debug Configuration PHP Code Injection
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
10Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4
PrestaShop contains an authenticated PHP code injection vulnerability in the back-office Performance debug-mode configuration. A back-office user with permission to modify debug settings can supply a crafted `debug_cookie_name` or `debug_cookie_value` that is written without sufficient escaping into a PHP configuration file. When PrestaShop subsequently loads the generated file, the injected PHP code is executed with the privileges of the web-server process.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
PrestaShop · PrestaShopCVEs relacionadas — PrestaShop
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-34716CRITICALPrestaShop vulnerable to XSS via customer contact form in FO, through file uploadEPSS 57.7%CVE-2020-15160—Blind SQL Injection in PrestaShopEPSS 10.8%CVE-2022-31181CRITICALRemote code execution in prestashopEPSS 7.7%CVE-2021-43789HIGHBlind SQLi using Search filters in PrestaShopEPSS 4.7%CVE-2021-21302MEDIUMCSV Injection via csv exportEPSS 2.4%CVE-2021-21308MEDIUMImproper session management for soft logoutEPSS 1.9%