Your report
completed 1 day agoThe deeper exposed-file checks were skipped — authorisation wasn't confirmed at scan time. Re-scan with the box ticked to include them.
Security grade
Needs attention — real weaknesses are present.
https://autosparks.co.uk/
Start here — fix these first
- 01 critical Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
- 02 medium Full REST API schema publicly disclosed
- 03 medium Older critical CVEs on this branch — verify your patch level
- 04 medium SPF discloses direct server IPs (possible WAF/CDN bypass)
- 05 low DMARC policy is monitor-only (p=none)
8 findings · scanned in 16,874 ms · engine 1.0.0 · intelligence vault 2026.08.2
Compliance & exposure lens
PCI DSS 4.0.1 · UK GDPR / PECRHow these findings map to your obligations. 3 indicators of a gap to investigate. These are indicators from an external scan, not a compliance certification.
PCI DSS 4.0.1
-
review 6.4.3 Payment-page scripts are managed and authorised
We rendered the checkout page and inventoried its scripts with no unmanaged third-party script found, but a complete 6.4.3 inventory of the authenticated payment step needs a full checkout walk we do not perform passively.
-
n/a 11.6.1 Unauthorised change detection on payment pages
A one-off external scan cannot verify ongoing change detection — this requires continuous, scheduled monitoring of the payment page.
-
gap 6.3.3 Known vulnerabilities are patched
The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.
- Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
- Older critical CVEs on this branch — verify your patch level
-
ok 4.2.1 Strong cryptography for data in transit
The checks observable from outside passed. This is not a certification.
-
gap 2.2.1 Secure configuration; no unnecessary exposure
The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.
- Full REST API schema publicly disclosed
- SOAP WSDL service list publicly accessible
UK GDPR / PECR
-
gap GDPR Art. 32 Security of processing (personal data)
The mapped finding(s) below indicate this requirement is likely not being met — investigate and remediate.
- Appears exposed to SessionReaper (CVE-2025-54236) if unpatched
- Older critical CVEs on this branch — verify your patch level
-
n/a PECR reg. 6 Consent before non-essential cookies
We render the landing page and flag any tracker that fires before consent; none was caught here, but a passive load cannot audit every template, so we do not certify consent compliance either way.
PCI 11.6.1 needs continuous change detection. Watch this payment page for injected scripts and header changes — daily, with an alert on any change.
Monitor this payment pageCritical 1
- form_key
- present
- mage_init
- present
- page_wrapper
- present
- section_data
- present
- mage_translate
- present
- magento_header
- X-Magento-Cache-Debug
- requirejs_mage
- present
- x-magento-init
- present
- inferred_branch
- 2.x
- magento_modules
- present
- static_frontend
- present
- static_version_path
- present
Apply Adobe's APSB25-88 emergency hotfix (VULN-32437) immediately, then rebuild. Actively exploited — treat as urgent, not routine.
-
1
Apply the APSB25-88 isolated hotfix (VULN-32437) for your release line — it closes this without a full upgrade — then rebuild.
bin/magento setup:upgrade && bin/magento cache:flush
-
2
If there is any sign of exploitation, assume session/admin compromise: invalidate all sessions and rotate admin credentials and integration tokens.
bin/magento admin:user:unlock; # then flush the session store to force re-authentication
-
3
Optional: move to a patched release on your line. Use your edition's metapackage and the exact fixed version from the advisory.
composer require magento/product-<your-edition>-edition:<fixed-version> --no-update && composer update
Medium 3
- bytes
- 113158
- endpoint
- /rest/all/schema?services=all
Restrict schema/API discovery in production.
-
1
Block the schema endpoint at the edge (legitimate clients do not need it).
location ~* ^/rest/(all|default)/schema { deny all; return 404; } -
2
Rate-limit /rest and require authentication for non-guest resources.
- form_key
- present
- mage_init
- present
- older_cves
- CVE-2024-34102, CVE-2022-24086
- page_wrapper
- present
- section_data
- present
- mage_translate
- present
- magento_header
- X-Magento-Cache-Debug
- requirejs_mage
- present
- x-magento-init
- present
- inferred_branch
- 2.x
- magento_modules
- present
- static_frontend
- present
- static_version_path
- present
Confirm the store is on the latest patch for its release line.
-
1
Check the running version against the latest patch for your line.
bin/magento --version
-
2
If behind, apply the latest security patches (isolated hotfixes exist for each of these), then rebuild.
composer update && bin/magento setup:upgrade && bin/magento cache:flush
- count
- 3
- domain
- autosparks.co.uk
- spf_ips
- 198.37.154.193, 212.84.164.81, 161.35.160.48
Keep the mail-sending IPs separate from the web origin, and firewall the origin to your CDN.
-
1
Restrict the origin to accept HTTP only from your CDN/WAF IP ranges (e.g. Cloudflare Authenticated Origin Pulls or an IP allowlist).
-
2
Send mail from a dedicated relay/IP that is not the web origin, so SPF never discloses the origin address.
Low 2
- dmarc
- v=DMARC1; p=none
Publish a DMARC policy and tighten it once aligned.
-
1
Start in monitor mode to collect reports:
_dmarc TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain"
-
2
Once SPF/DKIM pass for all legitimate mail, enforce it:
_dmarc TXT "v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain"
- endpoint
- /soap/default?wsdl_list=1
Disable SOAP if unused, or restrict the endpoint.
-
1
Block the SOAP endpoint at the edge.
location ~* ^/(index.php/)?soap { deny all; return 404; }
Info 2
- form_key
- present
- mage_init
- present
- page_wrapper
- present
- section_data
- present
- mage_translate
- present
- magento_header
- X-Magento-Cache-Debug
- requirejs_mage
- present
- x-magento-init
- present
- magento_modules
- present
- static_frontend
- present
- static_version_path
- present
- Permissions-Policy
- absent
Declare a least-privilege Permissions-Policy.
-
1
nginx: restrict sensitive features.
add_header Permissions-Policy "geolocation=(), camera=(), microphone=()" always;
Full audit
47 checks performed
Version & CVEs
- Magento version disclosure Secure
- CosmicSting (CVE-2024-34102) verify
- TrojanOrder (CVE-2022-24086) verify
- SUPEE security patches Secure
- Supported release / end-of-life Secure
Exposed files
- app/etc/env.php Inconclusive
- app/etc/local.xml (Magento 1) Inconclusive
- .env file Inconclusive
- .git repository Inconclusive
- .svn metadata Inconclusive
- composer.lock Inconclusive
- composer.lock SBOM (exact versions + modules) Inconclusive
- app/etc/config.php Inconclusive
- Setup / upgrade application Inconclusive
- Legacy downloader Inconclusive
- phpinfo() page Inconclusive
- var/log exposure Inconclusive
- RELEASE_NOTES.txt Inconclusive
- pub/errors config Inconclusive
- Media directory listing Secure
Malware & skimmers
- Known malware signatures (Visbot / Gurulnc) Secure
- Known-bad script domains Secure
- Obfuscated JavaScript Secure
- Leaked keys in JavaScript Secure
Data exposure
- Public order RSS feed Secure
- Public stock RSS feed Secure
- REST API schema disclosure medium
- SOAP WSDL disclosure low
- GraphQL introspection Secure
- robots.txt / sitemap disclosure Secure
Transport & headers
- Content-Security-Policy Secure
- Strict-Transport-Security (HSTS) Secure
- Clickjacking (X-Frame-Options) Secure
- X-Content-Type-Options Secure
- Referrer-Policy Secure
- Permissions-Policy Secure
- Cookie Secure flag Secure
- Cookie HttpOnly flag Secure
- Cookie SameSite Secure
- TLS certificate & protocol Secure
- Server software disclosure Secure
Access surface
- Default admin path Secure
- Exposed admin tools (Magmi, Adminer) Secure
- Frontend stack detection Secure
Email & exposure
- SPF record verify
- DMARC (spoofing / deliverability) low
- Subdomain exposure (Certificate Transparency) Secure
To verify = a CVE that affects your branch if unpatched. We can't confirm your patch level remotely — check it against the referenced advisory.
Share this report