Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Ports are not shown in third-party site redirect warning page.#482170	Duplicate	No weakness recorded	–	2019-04-12	–	–
Email Spoofing#276614	Duplicate	Misconfiguration and Insecure Design	–	2018-03-13	–	1
Security misconfiguration "weak passwords".#285482	Informative	Misconfiguration and Insecure Design	–	2018-03-13	–	1
SSLv3 Poodle Attack on Ip Of semrush#318594	N/A	Misconfiguration and Insecure Design	–	2018-03-13	–	1
clickjacking to Semrush auth login#318295	Informative	Misconfiguration and Insecure Design	–	2018-03-13	–	2
Insecure Direct Object Reference on API without API key#284963	Informative	No weakness recorded	–	2018-03-13	–	4
Cross-origin resource sharing#288912	Informative	No weakness recorded	–	2018-01-11	–	4
User Controllable Cookie#459502	N/A	No weakness recorded	–	2018-12-21	–	4
Persistent CSV injection#459532	N/A	No weakness recorded	–	2019-01-11	–	4
Broken Authentication: A project addition request can be used multiple time for different users#319480	Informative	Cryptography	–	2018-03-13	–	5
CORS (Cross-Origin Resource Sharing)#310579	Informative	Authentication	–	2018-03-20	–	6
Cross-origin resource sharing misconfig#311805	Duplicate	Authentication	–	2018-03-13	–	6
Improper authentication on registration#382667	N/A	Authentication	–	2018-08-24	–	7
Web cache deception attack - expose earning state information#439021	Informative	Access Control	–	2019-04-12	–	10
Single Sing On - Clickjacking#299009	Valid	Misconfiguration and Insecure Design	–	2018-02-21	–	11
Following links are vulnerable to clickjacking#289246	Valid	Misconfiguration and Insecure Design	–	2018-01-11	–	12
Post Based XSS On Upload Via CK Editor [semrush.com]#375352	Valid	Cross-site Scripting	–	2018-08-17	–	12
Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMB#786238	Valid	Cross-site Scripting	–	2020-04-02	–	12
protocol & Ports are not shown in third-party site redirect warning page#459286	Valid	Open Redirect	–	2019-01-11	–	14
php info file and sql backup at vendor's subdomain#1358249	Valid	Information Disclosure	–	2021-12-08	–	14
XSS on redirection page( Bypassed)#316319	Valid	Cross-site Scripting	–	2018-06-13	–	15
Content Injection on api.semrush.com to Reflected XSS#752042	Valid	Cross-site Scripting	–	2020-04-02	–	16
Ad Builder Display Ads Path Traversal#316713	Valid	File and Path Handling	–	2020-02-28	–	22
Code injection in https://www.semrush.com#723707	Valid	Command and Code Injection	–	2019-11-01	–	22
Reflected XSS using Header Injection#297203	Valid	Cross-site Scripting	–	2018-01-18	–	25
XSS Reflected on my_report#491023	Valid	Cross-site Scripting	–	2019-06-21	–	25
Open redirect in semrush.com#716976	Valid	Open Redirect	–	2019-10-25	–	26
Open Redirect#311330	Valid	Open Redirect	–	2018-12-07	–	28
Broken validation of user Id for JWT Token#853145	Valid	Input Validation and Logic	–	2020-12-11	–	32
Error Page Content Spoofing or Text Injection#327671	Valid	Misconfiguration and Insecure Design	–	2018-06-29	–	33
Improper input validation in projects leads to fully deny access to project resources#1237700	Valid	Input Validation and Logic	–	2021-09-01	–	35
Password reset token leakage via referer#342693	Valid	Misconfiguration and Insecure Design	–	2018-08-14	–	38
Manipulation of exam results at Semrush.Academy#662583	Valid	Input Validation and Logic	–	2019-10-11	–	38
subdomain takeover at news-static.semrush.com#294201	Valid	Access Control	–	2018-01-10	–	40
CORS misconfiguration which leads to the disclosure of certain data concerning the user.#769058	Valid	Access Control	–	2020-02-15	–	46
IDOR in semrush academy#783708	Valid	Insecure Direct Object Reference	–	2020-02-28	–	49
Stored XSS in '' Section and WAF Bypass#382625	Valid	Cross-site Scripting	–	2018-12-07	–	50
API key (api.semrush.com) leak in JS-file#1218754	Valid	Information Disclosure	–	2022-09-05	–	55
Exposure of service tokens to webpack bundle#1717210	Valid	Information Disclosure	–	2024-03-08	–	56
Critically Sensitive Spring Boot Endpoints Exposed#1022048	Valid	Access Control	–	2022-02-10	–	59
IDOR in marketing calendar tool#797685	Valid	Insecure Direct Object Reference	–	2020-04-02	–	64
Lack of sanitization of the billing address in pdf invoice#2077985	Valid	Server-Side Request Forgery	–	2024-03-06	–	66
[oauth token leak] at oauth.semrush.com#314814	Valid	Authentication	–	2018-04-17	–	70
IDOR allows information disclosure#1816900	Valid	Insecure Direct Object Reference	–	2024-03-05	–	74
SSRF and LFI in site-audit tool#794099	Valid	Server-Side Request Forgery	–	2020-04-30	–	86
Cross-origin resource sharing misconfig \| steal user information#235200	Valid	Misconfiguration and Insecure Design	–	2017-12-17	–	97
IDOR vulnerability reveals additional information#1770858	Valid	Insecure Direct Object Reference	–	2024-03-07	–	99
IDOR allowing to read another user's token on the Social Media Ads service#1464168	Valid	Access Control	–	2022-08-16	–	104
XXE in Site Audit function exposing file and directory contents#312543	Valid	Injection and Smuggling	–	2018-03-13	–	115
SSRF In Get Video Contents#643622	Valid	Server-Side Request Forgery	–	2019-08-19	–	125

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (227 analysed so far), which can be wrong. Data as of 2026-11-14.