PCI Compliance Release 1.9 API
August 19, 2026
We are introducing the following new enhancements for PCI Compliance Merchant APIs.
View Consolidated Findings for PCI and TAS Scans
We enhanced the PCI Compliance - TotalAppSec (TAS) integration to merge vulnerability findings from both the PCI and TAS scans for IP or DNS assets. This enhancement provides a consolidated view of unique vulnerabilities detected in both scans and ensures that no critical findings are overlooked during remediation.
To support this enhancement, we have updated the following PCI Merchant APIs.
Updated API: List Vulnerabilities API
| New or Updated API | Updated |
| API Endpoint | /pci/vuln/list |
| Method | GET |
| JSON Schema Changes | No |
We have updated the List Vulnerabilities API to display the consolidated vulnerability findings from the latest PCI Compliance and TAS scans. The API Response now contains only unique QIDs from both scans, avoiding duplication.
To learn more about this API, refer to the List Vulnerabilities API.
Sample: View Consolidated Vulnerability ListSample: View Consolidated Vulnerability List
The following sample displays the consolidated vulnerability data from the latest PCI Compliance and TAS scans.
API Request
curl --location '<qualys_base_url>/pci/vuln/list?
severity=CONFIRMED_MED%2CPOTENTIAL_HIGH%2CPOTENTIAL_MED%2CCONFIRMED_LOW%2CPOTENTIAL_LOW%2CCONFIRMED_HIGH&
ip=10.xx.xx.xx&limit=1000&offset=1' \
--header 'X-Requested-With: test' \
--header 'Authorization: Basic Authentication' \
--data ''
API Response
{
"responseApiVersion": "LATEST - V1",
"data": {
"totalCount": 8,
"fetchRange": "1-8",
"merchantVulnList": [
{
"id": 12345678,
"qid": 150017,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 23456789,
"qid": 150018,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 34567890,
"qid": 150019,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 45678901,
"qid": 150020,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 56789012,
"qid": 150021,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 67890123,
"qid": 150022,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 78901234,
"qid": 150023,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/13/2026",
"fpStatus": "NA",
"scanModule": "PCI"
},
{
"id": 89012345,
"qid": 150024,
"title": "Directory Listing",
"pciCompliant": "Fail",
"severity": "Confirmed Low",
"ip": "xx.xx.xx.xx",
"dns": null,
"dateLastScanned": "07/14/2026",
"fpStatus": "NA",
"scanModule": "WAS"
}
]
}
}
Updated API: Get Consolidated Vulnerability Data API
| New or Updated API | Updated |
| API Endpoint | /pci/vuln/consolidated |
| Method | GET |
| JSON Schema Changes | No |
We have updated the Get Consolidated Vulnerability Data API to display vulnerability data from the latest PCI and TAS scans, avoiding duplication of vulnerability data.
To learn more about this API, refer to the Get Consolidated Vulnerability Data API.
The following sample displays consolidated vulnerability data with unique detection from the latest PCI Compliance and TAS scans.
API Request
curl --location '<qualys_base_url>/vuln/consolidated?
qid=150023&ip=10.xx.xx.xx&severity=CONFIRMED_MED%2CPOTENTIAL_HIGH%2CPOTENTIAL_MED%2CCONFIRMED_LOW%2CPOTENTIAL_LOW%2CCONFIRMED_HIGH&
limit=1000&offset=1' \
--header 'X-Requested-With: test' \
--header 'Authorization: Basic Authentication' ' \
--data ''
API Response
{ "responseApiVersion": "LATEST - V1", "data": { "totalCount": 8, "fetchRange": "1-8", "merchantVulnConsolidatedList": [ { "id": 33360703, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip": "xx.xx.xx.xx", "dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "80", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx/icons/small/\nPayload: http://xx.xx.xx.xx/icons/small/\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /icons/small</title>\n </head>\n <body>\n Index of /icons/small \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PAREN" }, { "id": 33360708, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip": "xx.xx.xx.xx", "dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "8082", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx:8082/dvwa/images/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /dvwa/images</title>\n </head>\n <body>\n Index of /dvwa/images \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PAREN\n\nurl: http://10.11.68.60:8082/dvwa/includes/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /dvwa/includes</title>\n </head>\n <body>\n Index of /dvwa/includes \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[P\n\nurl: http://10.11.68.60:8082/dvwa/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /dvwa</title>\n </head>\n <body>\n Index of /dvwa \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PARENTDIR]\"></td><t\n\nurl: http://10.11.68.60:8082/dvwa/includes/DBMS/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /dvwa/includes/DBMS</title>\n </head>\n <body>\n Index of /dvwa/includes/DBMS \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gi\n\nurl: http://10.11.68.60:8082/dvwa/css/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /dvwa/css</title>\n </head>\n <body>\n Index of /dvwa/css \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PARENTDIR]\"\n\nurl: http://10.11.68.60:8082/dvwa/js/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /dvwa/js</title>\n </head>\n <body>\n Index of /dvwa/js \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PARENTDIR]\"><" }, { "id": 33360714, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip": "xx.xx.xx.xx", "dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "8096", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx:8096/./\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!doctype html>\n<html>\n <head>\n <meta charset=\"utf-8\">\n <meta name=\"viewport\" content=\"width=device-width\">\n <title>Index of /./</title>\n <style type=\"text/css\">i.icon { display: block; height: 16px; width: 16px; }\ntable tr { white-space: nowrap; }\ntd.perms {}\ntd.file-size { text-align: right; padding-left: 1em; }\ntd.display-name { padding-left: 1em; }\ni.icon-_blank {\n background-image: url(\"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABAAAAAQCAYAAAAf8/9hAAAAGXRFWHRTb2Z0d2FyZQBBZ" }, { "id": 33360721, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip": "xx.xx.xx.xx", "dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "8086", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx:8086/sqlilabs/assets/img/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/img</title>\n </head>\n <body>\n Index of /sqlilabs/assets/img \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets</title>\n </head>\n <body>\n Index of /sqlilabs/assets \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/font-awesome/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/font-awesome</title>\n </head>\n <body>\n Index of /sqlilabs/assets/font-awesome \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/font-awesome/css/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/font-awesome/css</title>\n </head>\n <body>\n Index of /sqlilabs/assets/font-awesome/css \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"t\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/css/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/css</title>\n </head>\n <body>\n Index of /sqlilabs/assets/css \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/fonts/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/fonts</title>\n </head>\n <body>\n Index of /sqlilabs/assets/fonts \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/b\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/js/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/js</title>\n </head>\n <body>\n Index of /sqlilabs/assets/js \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gi\n\nurl: http://10.11.68.60:8086/sqlilabs/assets/font-awesome/fonts/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /sqlilabs/assets/font-awesome/fonts</title>\n </head>\n <body>\n Index of /sqlilabs/assets/font-awesome/fonts \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valig" }, { "id": 33360736, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip": "xx.xx.xx.xx", "dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "8087", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx:8087/xvwa/js/\nPayload: http://xx.xx.xx.xx:8087/xvwa/js/\n comment: This directory was discovered during the path test phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /xvwa/js</title>\n </head>\n <body>\n Index of /xvwa/js \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PARENTDIR]\"><\n\nurl: http://10.11.68.60:8087/xvwa/css/\nPayload: http://10.11.68.60:8087/xvwa/css/\ncomment: This directory was discovered during the path test phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /xvwa/css</title>\n </head>\n <body>\n Index of /xvwa/css \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PARENTDIR]\"" }, { "id": 33360741, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip":"xx.xx.xx.xx","dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "8088", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx:8088/css/blueprint/src/\n comment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /css/blueprint/src</title>\n </head>\n <body>\n Index of /css/blueprint/src \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\"\n\nurl: http://10.11.68.60:8088/css/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /css</title>\n </head>\n <body>\n Index of /css \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PARENTDIR]\"></td><td>\n\nurl: http://10.11.68.60:8088/css/blueprint/plugins/fancy-type/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /css/blueprint/plugins/fancy-type</title>\n </head>\n <body>\n Index of /css/blueprint/plugins/fancy-type \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"t\n\nurl: http://10.11.68.60:8088/css/blueprint/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /css/blueprint</title>\n </head>\n <body>\n Index of /css/blueprint \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[P\n\nurl: http://10.11.68.60:8088/css/blueprint/plugins/\ncomment: This directory was discovered during the crawl phase.\n\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /css/blueprint/plugins</title>\n </head>\n <body>\n Index of /css/blueprint/plugins \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/b" }, { "id": 33360776, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip":"xx.xx.xx.xx","dns": null, "dateLastScanned": "07/13/2026", "fpStatus": "NA", "scanModule": "PCI", "operatingSystem": "EulerOS / SuSE Linux / Scientific Linux", "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "8089", "service": "Web Application", "protocol": "tcp", "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "url: http://xx.xx.xx.xx/icons/small/\nPayload: http://xx.xx.xx.xx/icons/small/\nmatched: <!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /icons/small</title>\n </head>\n <body>\n Index of /icons/small \n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th>Name (?C=N;O=D)</th><th>Last modified (?C=M;O=A)</th><th>Size (?C=S;O=A)</th><th>Description (?C=D;O=A)</th></tr>\n <tr><th colspan=\"5\"> </th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PAREN" }, { "id": 33361130, "qid": 150023, "title": "Directory Listing", "pciCompliant": "Fail", "severity": "Confirmed Low", "ip": "xx.xx.xx.xx", "dns": null, "dateLastScanned": "07/14/2026", "fpStatus": "NA", "scanModule": "WAS", "operatingSystem": null, "qualysSeverity": 2, "cvssBase": "null", "cvssTemporal": "null", "category": "Web Application", "port": "80", "service": "Web Application", "protocol": null, "bugTraqList": [], "cveList": [], "vendorReferenceList": [], "dateLastUpdate": "November 12, 2025 at 12:00 AM GMT", "threat": "The Web server presents a directory listing.", "impact": "All file names in this directory are exposed.", "solution": "The presence of a browseable directory does not necessarily imply a vulnerability. Determine if the directory listing is intended to be displayed. Verify that no files in the directory contain content that should not be served by the Web application.", "patch": null, "result": "<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n<html>\n <head>\n <title>Index of /icons/small</title>\n </head>\n <body>\n<h1>Index of /icons/small</h1>\n <table>\n <tr><th valign=\"top\"><img src=\"/icons/blank.gif\" alt=\"[ICO]\"></th><th><a href=\"?C=N;O=D\">Name</a></th><th><a href=\"?C=M;O=A\">Last modified</a></th><th><a href=\"?C=S;O=A\">Size</a></th><th><a href=\"?C=D;O=A\">Description</a></th></tr>\n <tr><th colspan=\"5\"><hr></th></tr>\n<tr><td valign=\"top\"><img src=\"/icons/back.gif\" alt=\"[PAREN" } ] } }
A
Updated API: Compliance Report Generation API
| New or Updated API | Updated |
| API Endpoint | /pci/reporting/reportGeneration/fetch |
| Method | GET |
| JSON Schema Changes | No |
We have updated the Compliance Report Generation API to display unique vulnerability data from the latest PCI Compliance and TAS scans. The API response does not report the duplicate detection.
To learn more about this API, refer to the Compliance Report Generation API.
The following API sample illustrates how to generate a consolidated compliance report for the latest PCI Compliance and TAS scans.
API Request
curl --location '<qualys_pci_api_url>/pci/reporting/reportGeneration/fetch' \
--header 'Content-Type: application/json' \
--header 'X-Requested-With: test' \
--header 'Authorization: Basic Authentication' \
--data ''
API Reponse
{
"responseApiVersion": "LATEST - V1",
"data": {
"specialNotes": [
{
"id": "33361130",
"ip": "xx.xx.xx.xxx",
"dns": null,
"specialNote": "Web Servers",
"qid": "150023",
"title": "Directory Listing",
"port": "80",
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33361132",
"ip": "xx.xx.xx.xxx",
"dns": null,
"specialNote": "Web Servers",
"qid": "150004",
"title": "Predictable Resource Location Via Forced Browsing",
"port": "80",
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359109",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Unknown services",
"qid": "82023",
"title": "Open TCP Services List",
"port": null,
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359115",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Remote Access",
"qid": "42017",
"title": "Remote Access or Management Service Detected",
"port": null,
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359243",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150004",
"title": "Predictable Resource Location Via Forced Browsing",
"port": "443",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359323",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Embedded links or code from out-of-scope domains",
"qid": "730109",
"title": "Apache HTTP Server Multiple Vulnerabilities",
"port": "443",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359373",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Embedded links or code from out-of-scope domains",
"qid": "730109",
"title": "Apache HTTP Server Multiple Vulnerabilities",
"port": "443",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359239",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "",
"qid": "86445",
"title": "Web Directories Listable Vulnerability",
"port": "443",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359249",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "",
"qid": "86445",
"title": "Web Directories Listable Vulnerability",
"port": "8070",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359252",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "",
"qid": "86445",
"title": "Web Directories Listable Vulnerability",
"port": "8085",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359400",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Embedded links or code from out-of-scope domains",
"qid": "730109",
"title": "Apache HTTP Server Multiple Vulnerabilities",
"port": "8085",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359256",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150004",
"title": "Predictable Resource Location Via Forced Browsing",
"port": "8085",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359242",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150023",
"title": "Directory Listing",
"port": "443",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359250",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150023",
"title": "Directory Listing",
"port": "8070",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359255",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150023",
"title": "Directory Listing",
"port": "8085",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359370",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150059",
"title": "Reference to Windows file path is present in HTML",
"port": "443",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33359385",
"ip": "xx.xx.xx.xxx",
"dns": "dns_url.com",
"specialNote": "Web Servers",
"qid": "150059",
"title": "Reference to Windows file path is present in HTML",
"port": "8085",
"protocol": "tcp",
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33346372",
"ip": "xx.xx.xxx.xx",
"dns": "dns_url.com",
"specialNote": "",
"qid": "82004",
"title": "Open UDP Services List",
"port": null,
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33346374",
"ip": "xx.xx.xxx.xx",
"dns": "dns_url.com",
"specialNote": "Remote Access",
"qid": "42017",
"title": "Remote Access or Management Service Detected",
"port": null,
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
},
{
"id": "33346371",
"ip": "xx.xx.xxx.xx",
"dns": "dns_url.com",
"specialNote": "Unknown services",
"qid": "82023",
"title": "Open TCP Services List",
"port": null,
"protocol": null,
"securelyImplemented": "false",
"comment": "Sample comment"
}
],
"nonCompliantAssets": [
{
"ip": "xx.xx.xx.xx",
"dns": null,
"vulnHigh": 0,
"vulnMed": 0,
"vulnLow": 6,
"asvComment": "Please update Apache to the latest versions.Update web server and web application configuration to disallow directory traversal.",
"sslComment": "",
"patches": [],
"merchantComment": "Sample comment"
},
{
"ip": "xx.xx.xxx.xx",
"dns": "dns_url.com",
"vulnHigh": 0,
"vulnMed": 0,
"vulnLow": 213,
"asvComment": "Please update Windows OS, Apache to the latest versions.Mitigate web application issues like XSS and SQL Injection. Update web server and web application configuration to disallow directory traversal. Restrict access to databases from the Internet. Fix SSL certificate related issues.",
"sslComment": "",
"patches": [],
"merchantComment": "Sample comment"
},
{
"ip": "xx.xx.xx.xxx",
"dns": null,
"vulnHigh": 0,
"vulnMed": 0,
"vulnLow": 1,
"asvComment": null,
"sslComment": null,
"patches": [],
"merchantComment": "Sample comment"
},
{
"ip": "xx.xx.xxx.xx",
"dns": "dns_url.com",
"vulnHigh": 0,
"vulnMed": 0,
"vulnLow": 70,
"asvComment": "Mitigate web application issues like XSS and SQL Injection.",
"sslComment": "",
"patches": [],
"merchantComment": "Sample comment"
}
]
}
}
Updated API: Compliance Summary Report API
| New or Updated API | Updated |
| API Endpoint | /pci/compliance/summary |
| Method | GET |
| JSON Schema Changes | No |
We have updated the Compliance Summary API to include all unique assets from the latest PCI Compliance and TAS scans, with their compliance status, in the API response.
To learn more about this API, refer to the Compliance Summary Report API.
The following sample illustrates how to generate consolidated PCI Compliance Summary Report. The compliance summary report contains the consolidated findings from both the latest PCI and WAS scan.
API Request
curl -X GET '<qualys_base_url>/pci/reporting/complianceSummary?limit=10&offset=0'
-H 'Content-Type: application/json apiVersion: V1'
API Response
{
"responseApiVersion": "LATEST - V1",
"data": {
"totalCount": 4264,
"fetchRange": "1-10",
"complianceSummaryList": [
{
"ip": "123.123.123.141",
"dns": "123.123.123.130.bc.googleusercontent.com",
"complianceStatus": "Pass"
},
{
"ip": "123.123.123.129",
"dns": "docker-registry.ab2.us-abcdefg-1.oracleiaas.com",
"complianceStatus": "Pass"
},
{
"ip": "12.123.123.250",
"dns": "ec2-12-123-12-250.sa-east-1.compute.amazonaws.com",
"complianceStatus": "Pass"
},
{
"ip": "1.1.1.5",
"dns": "abc.com",
"complianceStatus": "Pass"
},
{
"ip": "12.12.12.14",
"dns": "telemetry-api.ad1.ap-mumbai-1.oracleiaas.com",
"complianceStatus": "Pass"
},
{
"ip": "123.123.0.145",
"dns": "telemetry-api.ad1.ca-toronto-1.oracleiaas.com",
"complianceStatus": "Pass"
},
{
"ip": "123.123.1.146",
"dns": "telemetry-api.ad3.us-ashburn-1.oracleiaas.com",
"complianceStatus": "Pass"
},
{
"ip": "1.1.1.3",
"dns": "xyz.com",
"complianceStatus": "Fail"
},
{
"ip": "123.12.123.34",
"dns": null,
"complianceStatus": "Pass"
},
{
"ip": "123.12.12.7",
"dns": null,
"complianceStatus": "Pass"
}
]
}
}