Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
StatusAny
WeaknessAny class
- Any class
- Cross-site Scripting7
- Open Redirect3
- Server-Side Request Forgery3
- Command and Code Injection2
- Injection and Smuggling1
- File and Path Handling1
- Input Validation and Logic4
- Misconfiguration and Insecure Design10
- Cryptography1
- Information Disclosure5
- Authentication4
- Access Control6
- Insecure Direct Object Reference4
- No weakness recorded5
Access (analysis)Any
56 of 15,219 reports · 161 analysed so far
- #403417ValidAnalysedRemote Code Execution on www.semrush.com/my_reports on Logo uploadSemrush · Command and Code Injection · 2019 · needs: a user account · OS command injection, Unsafe file upload–824votes
- #676212ValidAnalysedGithub information leakedSemrush · Information Disclosure · 2019 · needs: no account · Information disclosure–344votes
- #771694ValidAn attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossSemrush · Input Validation and Logic · 2020–267votes
- #861940ValidOAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageSemrush · Information Disclosure · 2020–265votes
- #837400ValidIDOR in the https://market.semrush.com/Semrush · Access Control · 2020–173votes
- #748903ValidUnrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageSemrush · Misconfiguration and Insecure Design · 2020–133votes
- #643622ValidSSRF In Get Video ContentsSemrush · Server-Side Request Forgery · 2019–125votes
- #312543ValidXXE in Site Audit function exposing file and directory contentsSemrush · Injection and Smuggling · 2018–115votes
- #1464168ValidIDOR allowing to read another user's token on the Social Media Ads serviceSemrush · Access Control · 2022–104votes
- #1770858ValidIDOR vulnerability reveals additional informationSemrush · Insecure Direct Object Reference · 2024–99votes
- #235200ValidCross-origin resource sharing misconfig | steal user informationSemrush · Misconfiguration and Insecure Design · 2017–97votes
- #794099ValidSSRF and LFI in site-audit toolSemrush · Server-Side Request Forgery · 2020–86votes
- #1816900ValidIDOR allows information disclosureSemrush · Insecure Direct Object Reference · 2024–74votes
- #314814Valid[oauth token leak] at oauth.semrush.comSemrush · Authentication · 2018–70votes
- #2077985ValidLack of sanitization of the billing address in pdf invoiceSemrush · Server-Side Request Forgery · 2024–66votes
- #797685ValidIDOR in marketing calendar toolSemrush · Insecure Direct Object Reference · 2020–64votes
- #1022048ValidCritically Sensitive Spring Boot Endpoints ExposedSemrush · Access Control · 2022–59votes
- #1717210ValidExposure of service tokens to webpack bundleSemrush · Information Disclosure · 2024–56votes
- #1218754ValidAPI key (api.semrush.com) leak in JS-fileSemrush · Information Disclosure · 2022–55votes
- #382625ValidStored XSS in '' Section and WAF BypassSemrush · Cross-site Scripting · 2018–50votes
- #783708ValidIDOR in semrush academySemrush · Insecure Direct Object Reference · 2020–49votes
- #769058ValidCORS misconfiguration which leads to the disclosure of certain data concerning the user.Semrush · Access Control · 2020–46votes
- #294201Validsubdomain takeover at news-static.semrush.comSemrush · Access Control · 2018–40votes
- #662583ValidManipulation of exam results at Semrush.AcademySemrush · Input Validation and Logic · 2019–38votes
- #342693ValidPassword reset token leakage via refererSemrush · Misconfiguration and Insecure Design · 2018–38votes
- #1237700ValidImproper input validation in projects leads to fully deny access to project resourcesSemrush · Input Validation and Logic · 2021–35votes
- #327671ValidError Page Content Spoofing or Text InjectionSemrush · Misconfiguration and Insecure Design · 2018–33votes
- #853145ValidBroken validation of user Id for JWT TokenSemrush · Input Validation and Logic · 2020–32votes
- #311330ValidOpen RedirectSemrush · Open Redirect · 2018–28votes
- #716976ValidOpen redirect in semrush.comSemrush · Open Redirect · 2019–26votes
- #491023ValidXSS Reflected on my_reportSemrush · Cross-site Scripting · 2019–25votes
- #297203ValidReflected XSS using Header InjectionSemrush · Cross-site Scripting · 2018–25votes
- #723707ValidCode injection in https://www.semrush.comSemrush · Command and Code Injection · 2019–22votes
- #316713ValidAd Builder Display Ads Path TraversalSemrush · File and Path Handling · 2020–22votes
- #752042ValidContent Injection on api.semrush.com to Reflected XSSSemrush · Cross-site Scripting · 2020–16votes
- #316319ValidXSS on redirection page( Bypassed)Semrush · Cross-site Scripting · 2018–15votes
- #1358249Validphp info file and sql backup at vendor's subdomainSemrush · Information Disclosure · 2021–14votes
- #459286Validprotocol & Ports are not shown in third-party site redirect warning pageSemrush · Open Redirect · 2019–14votes
- #786238ValidReflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMBSemrush · Cross-site Scripting · 2020–12votes
- #375352ValidPost Based XSS On Upload Via CK Editor [semrush.com]Semrush · Cross-site Scripting · 2018–12votes
- #289246ValidFollowing links are vulnerable to clickjackingSemrush · Misconfiguration and Insecure Design · 2018–12votes
- #299009ValidSingle Sing On - ClickjackingSemrush · Misconfiguration and Insecure Design · 2018–11votes
- #439021InformativeWeb cache deception attack - expose earning state informationSemrush · Access Control · 2019–10votes
- #382667N/AImproper authentication on registrationSemrush · Authentication · 2018–7votes
- #311805DuplicateCross-origin resource sharing misconfigSemrush · Authentication · 2018–6votes
- #310579InformativeCORS (Cross-Origin Resource Sharing)Semrush · Authentication · 2018–6votes
- #319480InformativeBroken Authentication: A project addition request can be used multiple time for different usersSemrush · Cryptography · 2018–5votes
- #459532N/APersistent CSV injectionSemrush · No weakness recorded · 2019–4votes
- #459502N/AUser Controllable CookieSemrush · No weakness recorded · 2018–4votes
- #288912InformativeCross-origin resource sharingSemrush · No weakness recorded · 2018–4votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.