We have installed patches to out Magento sites (v1.9, patches 1533 5994 and 6285 (both versions)). However, despite installation reported successful, and after taking note of steps in Applied Patches but still getting a vulnerable message? We are still being told by http://magento.com/security-patch that the site is vulnerable. Checking on https://templates-master.com/supeechecker lists the 3 patches we have applied as those missing. Is there any other steps that are required, but not mentioned in the post mentioned above?


You missed the one patch that addresses the "Shoplift" exploit SUPEE-5345 And this is the only one that the byte shoplift tester on magento.com tests for.

I don't know how reliable the templates-master tool is, but to be absolutely sure that the patches have been installed, please refer to: How to check if Magento patch has been installed?


Please check if you have copies in app/code/local of any of the files listed in etc/applied.patches.list which would render the patch useless. Class rewrites could also be a problem, if they copy lots of code from the original class.

See also:

  • Thanks for your input, however I have now installed 5345 (as 5344 for v1.9), cleared cache, restarted apache, checked applied.patches.list, and all appears good, but tools are still reporting vulnerabilities?? – user3867548 Jul 20 '15 at 7:29
  • See update for another possible reason – Fabian Schmengler Jul 20 '15 at 7:43
  • Still no good sadly. Could not get the rewrites list to work. No files in app/code/local that match applied patch list either. – user3867548 Jul 21 '15 at 6:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.