Semrush Program Statistics

View program

57 total issues disclosed

$31,766 total paid publicly

Most disclosed (8 disclosures) — None supplied

Disclosed Reports

Report Title Vulnerability Type Disclosed By Severity Disclosed on
Exposure of service tokens to webpack bundle Information Disclosure a_d_a_m High 2024-03-08
IDOR vulnerability reveals additional information Insecure Direct Object Reference (IDOR) a_d_a_m Critical 2024-03-07
Lack of sanitization of the billing address in pdf invoice Server-Side Request Forgery (SSRF) a_d_a_m High 2024-03-06
IDOR allows information disclosure Insecure Direct Object Reference (IDOR) a_d_a_m High 2024-03-05
API key (api.semrush.com) leak in JS-file Information Disclosure a_d_a_m Medium 2022-09-05
IDOR allowing to read another user's token on the Social Media Ads service Improper Access Control - Generic a_d_a_m High 2022-08-16
Critically Sensitive Spring Boot Endpoints Exposed Improper Access Control - Generic a_d_a_m Critical 2022-02-10
php info file and sql backup at vendor's subdomain Information Disclosure rivalsec Low 2021-12-08
Improper input validation in projects leads to fully deny access to project resources Improper Input Validation a_d_a_m Medium 2021-09-01
Broken validation of user Id for JWT Token Business Logic Errors a_d_a_m Medium 2020-12-11
OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakage Information Disclosure yassineaboukir Medium 2020-06-18
IDOR in the https://market.semrush.com/ Improper Access Control - Generic albatraoz Critical 2020-04-30
SSRF and LFI in site-audit tool None supplied a_d_a_m High 2020-04-30
An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business loss Business Logic Errors yashrs High 2020-04-02
IDOR in marketing calendar tool Insecure Direct Object Reference (IDOR) a_d_a_m Medium 2020-04-02
Content Injection on api.semrush.com to Reflected XSS Cross-site Scripting (XSS) - Reflected nikitastupin Low 2020-04-02
Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMB Cross-site Scripting (XSS) - Reflected ziko_amazigh Low 2020-04-02
IDOR in semrush academy Insecure Direct Object Reference (IDOR) a_d_a_m Medium 2020-02-28
Ad Builder Display Ads Path Traversal Path Traversal ajxchapman Medium 2020-02-28
CORS misconfiguration which leads to the disclosure of certain data concerning the user. Improper Access Control - Generic a_d_a_m Low 2020-02-15
Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/image Violation of Secure Design Principles seeu Medium 2020-01-10
Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/image Violation of Secure Design Principles seeu Medium 2020-01-10
Code injection in https://www.semrush.com Code Injection dangkhai0x21 Medium 2019-11-01
Open redirect in semrush.com Open Redirect batuhanu Low 2019-10-25
Manipulation of exam results at Semrush.Academy Business Logic Errors r0hack Medium 2019-10-11
Github information leaked Information Disclosure farmsec_alice High 2019-09-25
SSRF In Get Video Contents Server-Side Request Forgery (SSRF) artemis233 Medium 2019-08-19
Remote Code Execution on www.semrush.com/my_reports on Logo upload Command Injection - Generic fransrosen Critical 2019-06-24
XSS Reflected on my_report Cross-site Scripting (XSS) - Reflected r0hack Low 2019-06-21
Web cache deception attack - expose earning state information Improper Access Control - Generic memon Low 2019-04-12
Ports are not shown in third-party site redirect warning page. None supplied b3f53dc9b2061f7df0c2ffd Low 2019-04-12
Persistent CSV injection None supplied 8r33 Medium 2019-01-11
protocol & Ports are not shown in third-party site redirect warning page Open Redirect 0xprial Low 2019-01-11
User Controllable Cookie None supplied 8r33 Low 2018-12-21
Stored XSS in '' Section and WAF Bypass Cross-site Scripting (XSS) - Stored jimgogogo Medium 2018-12-07
Open Redirect Open Redirect ankit_singh Low 2018-12-07
Improper authentication on registration Improper Authentication - Generic lezibintlgent Medium 2018-08-24
Post Based XSS On Upload Via CK Editor [semrush.com] Cross-site Scripting (XSS) - Reflected apapedulimu Low 2018-08-17
Password reset token leakage via referer Violation of Secure Design Principles ethical_hacker30121996 Low 2018-08-14
Error Page Content Spoofing or Text Injection Violation of Secure Design Principles asad_anwar Low 2018-06-29
XSS on redirection page( Bypassed) Cross-site Scripting (XSS) - Reflected kunal94 Low 2018-06-13
[oauth token leak] at oauth.semrush.com Improper Authentication - Generic nikitastupin High 2018-04-17
CORS (Cross-Origin Resource Sharing) Improper Authentication - Generic asad_anwar Low 2018-03-20
Email Spoofing Violation of Secure Design Principles protector47 Medium 2018-03-13
SSLv3 Poodle Attack on Ip Of semrush Violation of Secure Design Principles h3r0es Low 2018-03-13
Broken Authentication: A project addition request can be used multiple time for different users Key Exchange without Entity Authentication walterhwhite High 2018-03-13
clickjacking to Semrush auth login UI Redressing (Clickjacking) karrrtik None 2018-03-13
XXE in Site Audit function exposing file and directory contents XML External Entities (XXE) achapman Critical 2018-03-13
Cross-origin resource sharing misconfig Improper Authentication - Generic asad_anwar Low 2018-03-13
Security misconfiguration "weak passwords". Violation of Secure Design Principles whitehatmmalam Medium 2018-03-13
Insecure Direct Object Reference on API without API key None supplied scraps High 2018-03-13
Single Sing On - Clickjacking UI Redressing (Clickjacking) r0p3 Low 2018-02-21
Reflected XSS using Header Injection Cross-site Scripting (XSS) - Reflected inferno- Low 2018-01-18
Cross-origin resource sharing None supplied sureshbudharapu High 2018-01-11
Following links are vulnerable to clickjacking UI Redressing (Clickjacking) karma1 Low 2018-01-11
subdomain takeover at news-static.semrush.com None supplied 0ways High 2018-01-10
Cross-origin resource sharing misconfig | steal user information None supplied bughunterboy Medium 2017-12-17