HexBrain
Sign in

Browse / Semrush

Semrush

56disclosed reports

See its reports on the map

What gets reported to Semrush

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Remote Code Execution on www.semrush.com/my_reports on Logo uploadCommand Injection - Generic · critical
    824 votes
  2. Github information leakedInformation Disclosure · high
    344 votes
  3. An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossBusiness Logic Errors · high
    267 votes
  4. OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageInformation Disclosure · medium
    265 votes
  5. IDOR in the https://market.semrush.com/Improper Access Control - Generic · critical
    173 votes
  6. Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageViolation of Secure Design Principles · medium
    133 votes
  7. SSRF In Get Video ContentsServer-Side Request Forgery (SSRF) · medium
    125 votes
  8. XXE in Site Audit function exposing file and directory contentsXML External Entities (XXE) · critical
    115 votes
  9. IDOR allowing to read another user's token on the Social Media Ads serviceImproper Access Control - Generic · high
    104 votes
  10. IDOR vulnerability reveals additional informationInsecure Direct Object Reference (IDOR) · critical
    99 votes
  11. Cross-origin resource sharing misconfig | steal user information Misconfiguration · medium
    97 votes
  12. SSRF and LFI in site-audit toolServer-Side Request Forgery (SSRF) · high
    86 votes
  13. IDOR allows information disclosureInsecure Direct Object Reference (IDOR) · high
    74 votes
  14. [oauth token leak] at oauth.semrush.comImproper Authentication - Generic · high
    70 votes
  15. Lack of sanitization of the billing address in pdf invoiceServer-Side Request Forgery (SSRF) · high
    66 votes
  16. IDOR in marketing calendar toolInsecure Direct Object Reference (IDOR) · medium
    64 votes
  17. Critically Sensitive Spring Boot Endpoints ExposedImproper Access Control - Generic · critical
    59 votes
  18. Exposure of service tokens to webpack bundleInformation Disclosure · high
    56 votes
  19. API key (api.semrush.com) leak in JS-fileInformation Disclosure · medium
    55 votes
  20. Stored XSS in '' Section and WAF BypassCross-site Scripting (XSS) - Stored · medium
    50 votes
  21. IDOR in semrush academyInsecure Direct Object Reference (IDOR) · medium
    49 votes
  22. CORS misconfiguration which leads to the disclosure of certain data concerning the user.Improper Access Control - Generic · low
    46 votes
  23. subdomain takeover at news-static.semrush.comImproper Access Control - Generic · high
    40 votes
  24. Manipulation of exam results at Semrush.AcademyBusiness Logic Errors · medium
    38 votes
  25. Password reset token leakage via refererViolation of Secure Design Principles · low
    38 votes
  26. Improper input validation in projects leads to fully deny access to project resourcesImproper Input Validation · medium
    35 votes
  27. Error Page Content Spoofing or Text Injection Violation of Secure Design Principles · low
    33 votes
  28. Broken validation of user Id for JWT TokenBusiness Logic Errors · medium
    32 votes
  29. Open RedirectOpen Redirect · low
    28 votes
  30. Open redirect in semrush.comOpen Redirect · low
    26 votes
  31. XSS Reflected on my_reportCross-site Scripting (XSS) - Reflected · low
    25 votes
  32. Reflected XSS using Header InjectionCross-site Scripting (XSS) - Reflected · low
    25 votes
  33. Code injection in https://www.semrush.comCode Injection · medium
    22 votes
  34. Ad Builder Display Ads Path TraversalPath Traversal · medium
    22 votes
  35. Content Injection on api.semrush.com to Reflected XSSCross-site Scripting (XSS) - Reflected · low
    16 votes
  36. XSS on redirection page( Bypassed) Cross-site Scripting (XSS) - Reflected · low
    15 votes
  37. php info file and sql backup at vendor's subdomainInformation Disclosure · low
    14 votes
  38. protocol & Ports are not shown in third-party site redirect warning page Open Redirect · low
    14 votes
  39. Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMBCross-site Scripting (XSS) - Reflected · low
    12 votes
  40. Post Based XSS On Upload Via CK Editor [semrush.com]Cross-site Scripting (XSS) - Reflected · low
    12 votes
  41. Following links are vulnerable to clickjackingUI Redressing (Clickjacking) · low
    12 votes
  42. Single Sing On - ClickjackingUI Redressing (Clickjacking) · low
    11 votes
  43. Web cache deception attack - expose earning state informationInformativeImproper Access Control - Generic · low
    10 votes
  44. Improper authentication on registrationN/AImproper Authentication - Generic · medium
    7 votes
  45. Cross-origin resource sharing misconfig DuplicateImproper Authentication - Generic · low
    6 votes
  46. CORS (Cross-Origin Resource Sharing)InformativeImproper Authentication - Generic · low
    6 votes
  47. Broken Authentication: A project addition request can be used multiple time for different usersInformativeKey Exchange without Entity Authentication · high
    5 votes
  48. Persistent CSV injectionN/ACode Injection · medium
    4 votes
  49. User Controllable CookieN/AMisconfiguration · low
    4 votes
  50. Cross-origin resource sharingInformativehigh
    4 votes
  51. Insecure Direct Object Reference on API without API keyInformativeInsecure Direct Object Reference (IDOR) · high
    4 votes
  52. clickjacking to Semrush auth loginInformativeUI Redressing (Clickjacking)
    2 votes
  53. SSLv3 Poodle Attack on Ip Of semrushN/AViolation of Secure Design Principles · low
    1 votes
  54. Security misconfiguration "weak passwords".InformativeViolation of Secure Design Principles · medium
    1 votes
  55. Email SpoofingDuplicateViolation of Secure Design Principles · medium
    1 votes
  56. Ports are not shown in third-party site redirect warning page.Duplicatelow