Disclosed bug bounty reports

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Remote Code Execution on www.semrush.com/my_reports on Logo uploadAnalysed#403417	Valid	Command and Code Injection	–	2019-06-24	–	824
Github information leakedAnalysed#676212	Valid	Information Disclosure	–	2019-09-25	–	344
An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossAnalysed#771694	Valid	Input Validation and Logic	–	2020-04-02	–	267
OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageAnalysed#861940	Valid	Information Disclosure	–	2020-06-18	–	265
IDOR in the https://market.semrush.com/Analysed#837400	Valid	Access Control	–	2020-04-30	–	173
Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/image#748903	Valid	Misconfiguration and Insecure Design	–	2020-01-10	–	133
SSRF In Get Video Contents#643622	Valid	Server-Side Request Forgery	–	2019-08-19	–	125
XXE in Site Audit function exposing file and directory contents#312543	Valid	Injection and Smuggling	–	2018-03-13	–	115
IDOR allowing to read another user's token on the Social Media Ads service#1464168	Valid	Access Control	–	2022-08-16	–	104
IDOR vulnerability reveals additional information#1770858	Valid	Insecure Direct Object Reference	–	2024-03-07	–	99
Cross-origin resource sharing misconfig \| steal user information#235200	Valid	Misconfiguration and Insecure Design	–	2017-12-17	–	97
SSRF and LFI in site-audit tool#794099	Valid	Server-Side Request Forgery	–	2020-04-30	–	86
IDOR allows information disclosure#1816900	Valid	Insecure Direct Object Reference	–	2024-03-05	–	74
[oauth token leak] at oauth.semrush.com#314814	Valid	Authentication	–	2018-04-17	–	70
Lack of sanitization of the billing address in pdf invoice#2077985	Valid	Server-Side Request Forgery	–	2024-03-06	–	66
IDOR in marketing calendar tool#797685	Valid	Insecure Direct Object Reference	–	2020-04-02	–	64
Critically Sensitive Spring Boot Endpoints Exposed#1022048	Valid	Access Control	–	2022-02-10	–	59
Exposure of service tokens to webpack bundle#1717210	Valid	Information Disclosure	–	2024-03-08	–	56
API key (api.semrush.com) leak in JS-file#1218754	Valid	Information Disclosure	–	2022-09-05	–	55
Stored XSS in '' Section and WAF Bypass#382625	Valid	Cross-site Scripting	–	2018-12-07	–	50
IDOR in semrush academy#783708	Valid	Insecure Direct Object Reference	–	2020-02-28	–	49
CORS misconfiguration which leads to the disclosure of certain data concerning the user.#769058	Valid	Access Control	–	2020-02-15	–	46
subdomain takeover at news-static.semrush.com#294201	Valid	Access Control	–	2018-01-10	–	40
Manipulation of exam results at Semrush.Academy#662583	Valid	Input Validation and Logic	–	2019-10-11	–	38
Password reset token leakage via referer#342693	Valid	Misconfiguration and Insecure Design	–	2018-08-14	–	38
Improper input validation in projects leads to fully deny access to project resources#1237700	Valid	Input Validation and Logic	–	2021-09-01	–	35
Error Page Content Spoofing or Text Injection#327671	Valid	Misconfiguration and Insecure Design	–	2018-06-29	–	33
Broken validation of user Id for JWT Token#853145	Valid	Input Validation and Logic	–	2020-12-11	–	32
Open Redirect#311330	Valid	Open Redirect	–	2018-12-07	–	28
Open redirect in semrush.com#716976	Valid	Open Redirect	–	2019-10-25	–	26
XSS Reflected on my_report#491023	Valid	Cross-site Scripting	–	2019-06-21	–	25
Reflected XSS using Header Injection#297203	Valid	Cross-site Scripting	–	2018-01-18	–	25
Code injection in https://www.semrush.com#723707	Valid	Command and Code Injection	–	2019-11-01	–	22
Ad Builder Display Ads Path Traversal#316713	Valid	File and Path Handling	–	2020-02-28	–	22
Content Injection on api.semrush.com to Reflected XSS#752042	Valid	Cross-site Scripting	–	2020-04-02	–	16
XSS on redirection page( Bypassed)#316319	Valid	Cross-site Scripting	–	2018-06-13	–	15
php info file and sql backup at vendor's subdomain#1358249	Valid	Information Disclosure	–	2021-12-08	–	14
protocol & Ports are not shown in third-party site redirect warning page#459286	Valid	Open Redirect	–	2019-01-11	–	14
Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMB#786238	Valid	Cross-site Scripting	–	2020-04-02	–	12
Post Based XSS On Upload Via CK Editor [semrush.com]#375352	Valid	Cross-site Scripting	–	2018-08-17	–	12
Following links are vulnerable to clickjacking#289246	Valid	Misconfiguration and Insecure Design	–	2018-01-11	–	12
Single Sing On - Clickjacking#299009	Valid	Misconfiguration and Insecure Design	–	2018-02-21	–	11

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (348 analysed so far), which can be wrong. Data as of 2026-11-14.