Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
3 of 15,219 reports · 227 analysed so far
- #403417ValidAnalysedRemote Code Execution on www.semrush.com/my_reports on Logo uploadSemrush · Command and Code Injection · 2019 · needs: a user account · OS command injection, Unsafe file upload–824votes
- #771694ValidAnalysedAn attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossSemrush · Input Validation and Logic · 2020 · needs: a user account · Business logic flaw, Price or quantity tampering–267votes
- #861940ValidAnalysedOAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageSemrush · Information Disclosure · 2020 · needs: a user account · OAuth redirect_uri abuse, Information disclosure–265votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.