Scan Results
The Scan Results screen shows the result history recorded by every scan. Where Scan Targets shows only the latest verdict per target, this screen keeps the earlier results of the same target too, which is what you use to compare before and after patching.
Browsing
| Filter | Does |
|---|---|
| Scan run | Shows the results of one scan only. Default: all |
| Verdict | Filters by verdict |
| Search | Finds by part of the URL or PHP version |
The list is newest first by scan time. The columns are scan time, URL, PHP version, vulnerable, verdict, SAPI and reason. A long reason is cut short; hover over it to see all of it.
CSV downloads every result matching the current filters.
Verdicts
| Verdict | Meaning |
|---|---|
| Vulnerable | A probe showed a crash signal, or the exposed PHP version is an unpatched one |
| Fixed | No crash signal, and the exposed PHP version is a patched one |
| No signal | No crash signal, and no PHP version exposed |
| Inconclusive | The request was rejected before reaching PHP (400, 403, 413, ...), the baseline request returned a server error, or the connection dropped before a probe response arrived |
| Error | The scan could not start because the baseline request failed to connect or timed out |
judged Vulnerable on its version alone, check the operating system vendor's advisory and the
installed package version as well.
No signal does not mean safe. The scanned page may be static rather than PHP, or the server may hide its version; register a path that PHP actually handles and scan it again.
Confirming the fix
Check the PHP version of the Vulnerable assets, upgrade them to a fixed release, and run Scan all again from the Scan Targets screen. When the new result turns to Fixed, the fix is done. The fixed releases and remediation steps are in the app's Vulnerability menu.