CVE-2006-4945: Cardway Digitalwebshop

Medium severity, CVSS 5.1. EPSS: 2.6% chance of exploitation in the next 30 days.

Multiple PHP remote file inclusion vulnerabilities in Cardway (aka Frederic Boudaud) DigitalWebShop 1.128 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the _PHPLIB[libdir] parameter to (1) rechnung.php or (2) prepend.php.

Affected products

• Cardway Digitalwebshop: version 1.110 only; version 1.120 only; version 1.128 only

Published 2006-09-23. Last modified 2026-06-16.