{"grade":{"score":53,"letter":"D","breakdown":{"cap_applied":null,"inferred_penalty":14,"confirmed_penalty":33,"inferred_penalty_capped":false}},"vault":{"version":"2026.08.2","released":"2026-08-05"},"schema":"magekwik.scan\/4","target":{"host":"cladco.co.uk","port":443,"origin":"https:\/\/cladco.co.uk","scheme":"https","base_path":""},"findings":[{"title":"Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","summary":"Store appears to be running Magento 2.x. If it is 2.4.8-p2 or earlier without the APSB25-88 emergency hotfix (VULN-32437), an unauthenticated improper-input-validation flaw in the Commerce REST API allows customer-session takeover and, under certain configurations, remote code execution. This is actively exploited in the wild \u2014 verify the exact patch level urgently. CVE-2025-54236 is on CISA's Known Exploited Vulnerabilities catalog \u2014 it is being exploited in the wild right now, so treat patching as urgent, not theoretical.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","frontend_hyva":"present","checkout_config":"present","inferred_branch":"2.x","static_frontend":"present","static_version_path":"present"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"cve_signatures","severity":"critical","confidence":"inferred","remediation":{"steps":[{"command":"bin\/magento setup:upgrade && bin\/magento cache:flush","description":"Apply the APSB25-88 isolated hotfix (VULN-32437) for your release line \u2014 it closes this without a full upgrade \u2014 then rebuild."},{"command":"bin\/magento admin:user:unlock; # then flush the session store to force re-authentication","description":"If there is any sign of exploitation, assume session\/admin compromise: invalidate all sessions and rotate admin credentials and integration tokens."},{"command":"composer require magento\/product-<your-edition>-edition:<fixed-version> --no-update && composer update","description":"Optional: move to a patched release on your line. Use your edition's metapackage and the exact fixed version from the advisory."}],"summary":"Apply Adobe's APSB25-88 emergency hotfix (VULN-32437) immediately, then rebuild. Actively exploited \u2014 treat as urgent, not routine.","reference":"https:\/\/helpx.adobe.com\/security\/products\/magento\/apsb25-88.html"}},{"title":"Content-Security-Policy is report-only (not enforced)","summary":"Only a Content-Security-Policy-Report-Only header is set \u2014 violations are reported but NOT blocked, so an injected inline skimmer still executes. Magento ships CSP in report-only by default; the storefront must be switched to restrict (enforced) mode to actually stop card skimmers.","evidence":{"facts":{"Content-Security-Policy":"absent","Content-Security-Policy-Report-Only":"font-src www.paypalobjects.com fonts.gstatic.com use.typekit.net *.typekit.net *.gstatic.com *.cdn-apple.com fonts.googleapis.com *.googleapis.com data: *.stripe.com *.stripecdn.com klarna.com *.kl\u2026"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"security_headers","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"bin\/magento config:set system\/csp\/mode\/storefront\/report_only 0","description":"Enforce the storefront CSP (0 = restrict\/enforced)."},{"command":"bin\/magento cache:flush config full_page","description":"Whitelist legitimate inline scripts\/domains via csp_whitelist.xml first to avoid breaking the storefront, then flush."}],"summary":"Switch Magento_Csp from report-only to enforced (restrict) mode for the storefront.","reference":"https:\/\/developer.adobe.com\/commerce\/php\/development\/security\/content-security-policies\/"}},{"title":"Cookies set without the Secure flag","summary":"Cookies are set over HTTPS without Secure, so they can be transmitted over a downgraded\/plaintext connection.","evidence":{"facts":{"affected_cookies":"wp_ga4_user_id, wp_ga4_customerGroup"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"cookie_flags","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"bin\/magento config:set web\/cookie\/cookie_httponly 1","description":"Magento cookie flags: set web\/cookie configuration and ensure the store is served exclusively over HTTPS."},{"command":"proxy_cookie_flags ~ secure samesite=lax;","description":"Enforce Secure + SameSite at the edge for cookies the app does not manage."}],"summary":"Set Secure on the affected cookies.","reference":null}},{"title":"GraphQL introspection enabled","summary":"The GraphQL schema is fully introspectable in production, handing an attacker the complete type\/field map \u2014 including custom modules \u2014 to plan targeted queries.","evidence":{"facts":{"query":"{__schema{queryType{name} types{name}}}","endpoint":"\/graphql"},"snippet":"{\"data\":{\"__schema\":{\"queryType\":{\"name\":\"Query\"},\"types\":[{\"name\":\"Query\"},{\"name\":\"String\"},{\"name\":\"Float\"},{\"name\":\"Boolean\"},{\"name\":\"Int\"},{\"name\":\"ID\"},{\"name\":\"Mutation\"},{\"name\":\"FilterTypeIn","observed_url":"https:\/\/cladco.co.uk\/graphql?query=%7B__schema%7BqueryType%7Bname%7D%20types%7Bname%7D%7D%7D"},"probe_id":"graphql_introspection","severity":"medium","confidence":"confirmed","remediation":{"steps":[{"command":"bin\/magento deploy:mode:set production","description":"Set the deployment mode to production (disables introspection by default)."},{"command":"bin\/magento cache:flush","description":"If a custom middleware\/plugin toggles it, ensure introspection is gated to non-production only, then flush cache."}],"summary":"Disable GraphQL introspection in production.","reference":"https:\/\/developer.adobe.com\/commerce\/webapi\/graphql\/"}},{"title":"Non-production subdomains exposed in Certificate Transparency logs","summary":"Public CT logs list 2 non-production-looking subdomain(s) for this domain (e.g. test.apps.cladco.co.uk, test.cladco.co.uk). Staging\/dev\/UAT hosts frequently run a copy of production data without a password, WAF, or up-to-date patches \u2014 a common back door. Confirm each is not publicly reachable.","evidence":{"facts":{"source":"crt.sh (Certificate Transparency)","total_flagged":"2","risky_subdomains":"test.apps.cladco.co.uk, test.cladco.co.uk"},"snippet":null,"observed_url":null},"probe_id":"ct_subdomains","severity":"medium","confidence":"inferred","remediation":{"steps":[{"command":null,"description":"Confirm which of these resolve and respond, then put them behind auth \/ an IP allowlist, or take them offline."},{"command":null,"description":"Never run production data on an unprotected staging host; scrub PII from non-prod databases."},{"command":null,"description":"Front non-prod with the same WAF\/CDN as production so they are not a soft target."}],"summary":"Lock down or take offline every non-production host.","reference":"https:\/\/crt.sh\/?q=%25.cladco.co.uk"}},{"title":"Older critical CVEs on this branch \u2014 verify your patch level","summary":"The store appears to be running Magento 2.x, but the exact patch level could not be determined. This branch has had critical, now-fixed vulnerabilities \u2014 CosmicSting (CVE-2024-34102, APSB24-40); TrojanOrder (CVE-2022-24086, APSB22-12). A store kept reasonably current already has these patches; if yours is NOT on the latest patch they are critical (unauthenticated RCE \/ data theft), and 2 are on CISA's Known Exploited Vulnerabilities catalog (actively exploited in the wild). Confirm your exact patch level.","evidence":{"facts":{"form_key":"present","mage_init":"present","older_cves":"CVE-2024-34102, CVE-2022-24086","page_wrapper":"present","section_data":"present","frontend_hyva":"present","checkout_config":"present","inferred_branch":"2.x","static_frontend":"present","static_version_path":"present"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"cve_signatures","severity":"medium","confidence":"inferred","remediation":{"steps":[{"command":"bin\/magento --version","description":"Check the running version against the latest patch for your line."},{"command":"composer update && bin\/magento setup:upgrade && bin\/magento cache:flush","description":"If behind, apply the latest security patches (isolated hotfixes exist for each of these), then rebuild."}],"summary":"Confirm the store is on the latest patch for its release line.","reference":"https:\/\/experienceleague.adobe.com\/docs\/commerce-operations\/release\/planning\/lifecycle-policy.html"}},{"title":"Referrer-Policy not set","summary":"No Referrer-Policy. Full URLs (including cart\/checkout tokens in query strings) may leak to third parties.","evidence":{"facts":{"Referrer-Policy":"absent"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"security_headers","severity":"low","confidence":"confirmed","remediation":{"steps":[{"command":"add_header Referrer-Policy \"strict-origin-when-cross-origin\" always;","description":"nginx: add to the server block."}],"summary":"Set a strict referrer policy.","reference":null}},{"title":"Appears to be running Magento 2.x","summary":"Platform inferred from passive signals. Treat the version as approximate \u2014 verify the exact patch level against the deployment.","evidence":{"facts":{"form_key":"present","mage_init":"present","page_wrapper":"present","section_data":"present","frontend_hyva":"present","checkout_config":"present","static_frontend":"present","static_version_path":"present"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"version_fingerprint","severity":"info","confidence":"inferred","remediation":null},{"title":"Permissions-Policy not set","summary":"No Permissions-Policy. Powerful browser features are not explicitly restricted for embedded third-party content.","evidence":{"facts":{"Permissions-Policy":"absent"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/"},"probe_id":"security_headers","severity":"info","confidence":"confirmed","remediation":{"steps":[{"command":"add_header Permissions-Policy \"geolocation=(), camera=(), microphone=()\" always;","description":"nginx: restrict sensitive features."}],"summary":"Declare a least-privilege Permissions-Policy.","reference":null}},{"title":"Static assets indicate version 2.4.3 or older","summary":"The tiny_mce_4 static path was retired after 2.4.3; its presence indicates an older, likely end-of-support branch. This narrows the version inferred from page markers alone \u2014 verify the exact patch level.","evidence":{"facts":{"source":"gwillem\/magento-version-identification; Adobe Commerce 2.4.4 release notes","implies":"2.4.3 or older","discriminator":"TinyMCE 4 admin bundle"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/static\/adminhtml\/Magento\/backend\/en_US\/tiny_mce_4\/tinymce.min.js"},"probe_id":"static_fingerprint","severity":"info","confidence":"inferred","remediation":null},{"title":"Static assets indicate version 2.4.4 or newer","summary":"Magento bundled TinyMCE 4 through 2.4.3 and upgraded to TinyMCE 5 in 2.4.4; the tiny_mce_5 static path exists only on 2.4.4 and later. This narrows the version inferred from page markers alone \u2014 verify the exact patch level.","evidence":{"facts":{"source":"gwillem\/magento-version-identification; Adobe Commerce 2.4.4 release notes","implies":"2.4.4 or newer","discriminator":"TinyMCE 5 admin bundle"},"snippet":null,"observed_url":"https:\/\/cladco.co.uk\/static\/adminhtml\/Magento\/backend\/en_US\/tiny_mce_5\/tinymce.min.js"},"probe_id":"static_fingerprint","severity":"info","confidence":"inferred","remediation":null}],"compliance":[{"ref":"6.4.3","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Payment-page scripts are managed and authorised","status":"gap","signals":["Content-Security-Policy is report-only (not enforced)"],"framework":"PCI DSS 4.0.1","requirement":"Every script loaded on the payment page must be inventoried, justified\/authorised, and its integrity assured (e.g. SRI or CSP)."},{"ref":"11.6.1","note":"A one-off external scan cannot verify ongoing change detection \u2014 this requires continuous, scheduled monitoring of the payment page.","title":"Unauthorised change detection on payment pages","status":"not_assessed","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Detect and alert on unauthorised changes to payment-page HTTP headers and script content, at least every seven days."},{"ref":"6.3.3","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Known vulnerabilities are patched","status":"gap","signals":["Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","Older critical CVEs on this branch \u2014 verify your patch level"],"framework":"PCI DSS 4.0.1","requirement":"Install applicable security patches; address critical vulnerabilities promptly."},{"ref":"4.2.1","note":"The checks observable from outside passed. This is not a certification.","title":"Strong cryptography for data in transit","status":"ok","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Use strong cryptography and secure protocols to protect cardholder data over open networks."},{"ref":"2.2.1","note":"The checks observable from outside passed. This is not a certification.","title":"Secure configuration; no unnecessary exposure","status":"ok","signals":[],"framework":"PCI DSS 4.0.1","requirement":"Harden system configuration and remove or restrict unnecessary services, files, and information disclosure."},{"ref":"GDPR Art. 32","note":"The mapped finding(s) below indicate this requirement is likely not being met \u2014 investigate and remediate.","title":"Security of processing (personal data)","status":"gap","signals":["Appears exposed to SessionReaper (CVE-2025-54236) if unpatched","Older critical CVEs on this branch \u2014 verify your patch level"],"framework":"UK GDPR \/ PECR","requirement":"Appropriate technical measures to protect customer personal data \u2014 encryption, resilience, and preventing unauthorised access."},{"ref":"PECR reg. 6","note":"We render the landing page and flag any tracker that fires before consent; none was caught here, but a passive load cannot audit every template, so we do not certify consent compliance either way.","title":"Consent before non-essential cookies","status":"not_assessed","signals":[],"framework":"UK GDPR \/ PECR","requirement":"Non-essential cookies (analytics, marketing, tag managers) must not be set before the visitor consents."}],"started_at":1790119821.887722,"duration_ms":20793,"finished_at":1790119842.680442,"engine_version":"1.0.0","probe_outcomes":[{"error":null,"status":"completed","probe_id":"waf","probe_name":"WAF \/ CDN scanner blocking","duration_ms":201,"findings_count":0},{"error":null,"status":"completed","probe_id":"version_fingerprint","probe_name":"Platform and version fingerprint","duration_ms":1755,"findings_count":1},{"error":null,"status":"completed","probe_id":"static_fingerprint","probe_name":"Static-asset version fingerprint","duration_ms":1335,"findings_count":2},{"error":null,"status":"completed","probe_id":"security_headers","probe_name":"Security response headers","duration_ms":0,"findings_count":3},{"error":null,"status":"completed","probe_id":"graphql_introspection","probe_name":"GraphQL introspection","duration_ms":2855,"findings_count":1},{"error":null,"status":"completed","probe_id":"cve_signatures","probe_name":"CVE signatures (inferred)","duration_ms":0,"findings_count":2},{"error":null,"status":"completed","probe_id":"cookie_flags","probe_name":"Cookie security flags","duration_ms":0,"findings_count":1},{"error":null,"status":"completed","probe_id":"tls_config","probe_name":"TLS configuration and certificate","duration_ms":79,"findings_count":0},{"error":null,"status":"completed","probe_id":"leaked_keys","probe_name":"Leaked keys in JavaScript","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"magecart_heuristics","probe_name":"Magecart \/ skimmer heuristics","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"media_listing","probe_name":"Media directory listing","duration_ms":1670,"findings_count":0},{"error":null,"status":"completed","probe_id":"default_admin_path","probe_name":"Default admin path","duration_ms":1477,"findings_count":0},{"error":null,"status":"completed","probe_id":"release_matrix","probe_name":"Adobe release-matrix status","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"robots_sitemap","probe_name":"robots.txt \/ sitemap disclosure","duration_ms":1748,"findings_count":0},{"error":null,"status":"completed","probe_id":"server_header","probe_name":"Server software disclosure","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"frontend_stack","probe_name":"Frontend stack","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"rss_leak","probe_name":"Public RSS feed leakage","duration_ms":1958,"findings_count":0},{"error":null,"status":"completed","probe_id":"rest_api","probe_name":"REST\/SOAP API disclosure","duration_ms":1596,"findings_count":0},{"error":null,"status":"completed","probe_id":"admin_tools","probe_name":"Exposed admin \/ database tools","duration_ms":3675,"findings_count":0},{"error":null,"status":"completed","probe_id":"mail_auth","probe_name":"Email authentication (SPF \/ DMARC)","duration_ms":40,"findings_count":0},{"error":null,"status":"completed","probe_id":"ct_subdomains","probe_name":"Certificate Transparency exposure","duration_ms":2226,"findings_count":1},{"error":null,"status":"completed","probe_id":"payment_page_scripts","probe_name":"Payment-page script inventory (PCI 6.4.3)","duration_ms":0,"findings_count":0},{"error":null,"status":"completed","probe_id":"consent_timing","probe_name":"Cookie consent timing (PECR \/ GDPR)","duration_ms":0,"findings_count":0}],"severity_counts":{"low":1,"high":0,"info":4,"medium":5,"critical":1},"audit":[{"id":"version_disclosure","name":"Magento version disclosure","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"cve_cosmicsting","name":"CosmicSting (CVE-2024-34102)","status":"needs_verification","category":"Version & CVEs","severity":"medium","finding_title":"Older critical CVEs on this branch \u2014 verify your patch level"},{"id":"cve_trojanorder","name":"TrojanOrder (CVE-2022-24086)","status":"needs_verification","category":"Version & CVEs","severity":"medium","finding_title":"Older critical CVEs on this branch \u2014 verify your patch level"},{"id":"supee_patches","name":"SUPEE security patches","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"release_support","name":"Supported release \/ end-of-life","status":"secure","category":"Version & CVEs","severity":null,"finding_title":null},{"id":"exp_envphp","name":"app\/etc\/env.php","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_localxml","name":"app\/etc\/local.xml (Magento 1)","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_dotenv","name":".env file","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_git","name":".git repository","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_svn","name":".svn metadata","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_composer","name":"composer.lock","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_sbom","name":"composer.lock SBOM (exact versions + modules)","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_configphp","name":"app\/etc\/config.php","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_setup","name":"Setup \/ upgrade application","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_downloader","name":"Legacy downloader","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_phpinfo","name":"phpinfo() page","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_varlog","name":"var\/log exposure","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_releasenotes","name":"RELEASE_NOTES.txt","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"exp_puberrors","name":"pub\/errors config","status":"inconclusive","category":"Exposed files","severity":null,"finding_title":null},{"id":"media_listing","name":"Media directory listing","status":"secure","category":"Exposed files","severity":null,"finding_title":null},{"id":"mal_named","name":"Known malware signatures (Visbot \/ Gurulnc)","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_badscript","name":"Known-bad script domains","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_obfuscated","name":"Obfuscated JavaScript","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"mal_leakedkeys","name":"Leaked keys in JavaScript","status":"secure","category":"Malware & skimmers","severity":null,"finding_title":null},{"id":"data_rss_order","name":"Public order RSS feed","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_rss_stock","name":"Public stock RSS feed","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_rest_schema","name":"REST API schema disclosure","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_soap","name":"SOAP WSDL disclosure","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"data_graphql","name":"GraphQL introspection","status":"at_risk","category":"Data exposure","severity":"medium","finding_title":"GraphQL introspection enabled"},{"id":"data_robots","name":"robots.txt \/ sitemap disclosure","status":"secure","category":"Data exposure","severity":null,"finding_title":null},{"id":"hdr_csp","name":"Content-Security-Policy","status":"at_risk","category":"Transport & headers","severity":"medium","finding_title":"Content-Security-Policy is report-only (not enforced)"},{"id":"hdr_hsts","name":"Strict-Transport-Security (HSTS)","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_xfo","name":"Clickjacking (X-Frame-Options)","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_nosniff","name":"X-Content-Type-Options","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"hdr_referrer","name":"Referrer-Policy","status":"at_risk","category":"Transport & headers","severity":"low","finding_title":"Referrer-Policy not set"},{"id":"hdr_permissions","name":"Permissions-Policy","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_secure","name":"Cookie Secure flag","status":"at_risk","category":"Transport & headers","severity":"medium","finding_title":"Cookies set without the Secure flag"},{"id":"cookie_httponly","name":"Cookie HttpOnly flag","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"cookie_samesite","name":"Cookie SameSite","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"tls_config","name":"TLS certificate & protocol","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"server_disclosure","name":"Server software disclosure","status":"secure","category":"Transport & headers","severity":null,"finding_title":null},{"id":"access_admin","name":"Default admin path","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"access_admintools","name":"Exposed admin tools (Magmi, Adminer)","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"access_frontend","name":"Frontend stack detection","status":"secure","category":"Access surface","severity":null,"finding_title":null},{"id":"mail_spf","name":"SPF record","status":"secure","category":"Email & exposure","severity":null,"finding_title":null},{"id":"mail_dmarc","name":"DMARC (spoofing \/ deliverability)","status":"secure","category":"Email & exposure","severity":null,"finding_title":null},{"id":"ct_subdomains","name":"Subdomain exposure (Certificate Transparency)","status":"needs_verification","category":"Email & exposure","severity":"medium","finding_title":"Non-production subdomains exposed in Certificate Transparency logs"}]}