Skip to content
Sign in

Bug bounty program

SE

Semrush

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
14
Disclosed reports
56
Subdomains
5,693

Most upvoted reports56

All reports
Most upvoted reports of Semrush
ReportWeaknessDisclosedBountyVotes
Remote Code Execution on www.semrush.com/my_reports on Logo uploadAnalysed#403417Command and Code Injection2019-06-24–824
Github information leakedAnalysed#676212Information Disclosure2019-09-25–344
An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossAnalysed#771694Input Validation and Logic2020-04-02–267
OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageAnalysed#861940Information Disclosure2020-06-18–265
IDOR in the https://market.semrush.com/Analysed#837400Access Control2020-04-30–173
Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageAnalysed#748903Misconfiguration and Insecure Design2020-01-10–133
SSRF In Get Video ContentsAnalysed#643622Server-Side Request Forgery2019-08-19–125
XXE in Site Audit function exposing file and directory contents#312543Injection and Smuggling2018-03-13–115
IDOR allowing to read another user's token on the Social Media Ads service#1464168Access Control2022-08-16–104
IDOR vulnerability reveals additional information#1770858Insecure Direct Object Reference2024-03-07–99

Subdomains5,693

Root
Scope
Name suggests:Internal
First seen
Text fileClear filters17 names
Subdomains of Semrush
NameScopeFirst seen
staff4-cis716.incites.thomsonreuters.com.skyline.apa.org.oak.sellzone.cominternalIn scope2026-11-14
corp.semrush.cominternalIn scope2026-11-14
internal.semrush.cominternalIn scope2026-11-14
intranet.semrush.cominternalIn scope2026-11-14
lm-dev.internal.backend.semrush.netdev, internalIn scope2026-11-14
lm-grey.internal.backend.semrush.netinternalIn scope2026-11-14
lm-rc.internal.backend.semrush.netinternalIn scope2026-11-14
lm-test.internal.backend.semrush.netinternal, testIn scope2026-11-14
lm-test-2.internal.backend.semrush.netinternal, testIn scope2026-11-14
tiger-lm-test-all0.internal.backend.semrush.netinternal, testIn scope2026-11-14
tiger-lm-test2-all0.internal.backend.semrush.netinternal, testIn scope2026-11-14
internal.semrush.netinternalIn scope2026-11-14
tiger-lm-test-all0.internal.semrush.netinternal, testIn scope2026-11-14
tiger-lm-test2-all0.internal.semrush.netinternal, testIn scope2026-11-14
tiger-lm-test3-all0.internal.semrush.netinternal, testIn scope2026-11-14
tiger-lm-test4-all0.internal.semrush.netinternal, testIn scope2026-11-14
tiger-lm-test5-all0.internal.semrush.netinternal, testIn scope2026-11-14

5,384 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in