PCI vulnerability scanning