Browse / Semrush

Semrush

See its reports on the map

Attack surface: 5,693 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Semrush

• Misconfiguration11
• Cross-site Scripting7
• Access Control6
• Information Disclosure5
• Insecure Direct Object Reference5
• Authentication5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Web cache deception attack - expose earning state informationInformativeImproper Access Control - Generic · low
   10 votes
2. CORS (Cross-Origin Resource Sharing)InformativeImproper Authentication - Generic · low
   6 votes
3. Broken Authentication: A project addition request can be used multiple time for different usersInformativeKey Exchange without Entity Authentication · high
   5 votes
4. Cross-origin resource sharingInformativehigh
   4 votes
5. Insecure Direct Object Reference on API without API keyInformativeInsecure Direct Object Reference (IDOR) · high
   4 votes
6. clickjacking to Semrush auth loginInformativeUI Redressing (Clickjacking)
   2 votes
7. Security misconfiguration "weak passwords".InformativeViolation of Secure Design Principles · medium
   1 votes