Browse / Semrush

Semrush

See its reports on the map

Attack surface: 5,693 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Semrush

• Misconfiguration11
• Cross-site Scripting7
• Access Control6
• Information Disclosure5
• Insecure Direct Object Reference5
• Authentication5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Remote Code Execution on www.semrush.com/my_reports on Logo uploadCommand Injection - Generic · critical
   824 votes
2. Github information leakedInformation Disclosure · high
   344 votes
3. An attacker can buy marketplace articles for lower prices as it allows for negative quantity values leading to business lossBusiness Logic Errors · high
   267 votes
4. OAuth `redirect_uri` bypass using IDN homograph attack resulting in user's access token leakageInformation Disclosure · medium
   265 votes
5. IDOR in the https://market.semrush.com/Improper Access Control - Generic · critical
   173 votes
6. Unrestricted file upload in www.semrush.com > /my_reports/api/v1/upload/imageViolation of Secure Design Principles · medium
   133 votes
7. SSRF In Get Video ContentsServer-Side Request Forgery (SSRF) · medium
   125 votes
8. XXE in Site Audit function exposing file and directory contentsXML External Entities (XXE) · critical
   115 votes
9. IDOR allowing to read another user's token on the Social Media Ads serviceImproper Access Control - Generic · high
   104 votes
10. IDOR vulnerability reveals additional informationInsecure Direct Object Reference (IDOR) · critical
    99 votes
11. Cross-origin resource sharing misconfig | steal user information Misconfiguration · medium
    97 votes
12. SSRF and LFI in site-audit toolServer-Side Request Forgery (SSRF) · high
    86 votes
13. IDOR allows information disclosureInsecure Direct Object Reference (IDOR) · high
    74 votes
14. [oauth token leak] at oauth.semrush.comImproper Authentication - Generic · high
    70 votes
15. Lack of sanitization of the billing address in pdf invoiceServer-Side Request Forgery (SSRF) · high
    66 votes
16. IDOR in marketing calendar toolInsecure Direct Object Reference (IDOR) · medium
    64 votes
17. Critically Sensitive Spring Boot Endpoints ExposedImproper Access Control - Generic · critical
    59 votes
18. Exposure of service tokens to webpack bundleInformation Disclosure · high
    56 votes
19. API key (api.semrush.com) leak in JS-fileInformation Disclosure · medium
    55 votes
20. Stored XSS in '' Section and WAF BypassCross-site Scripting (XSS) - Stored · medium
    50 votes
21. IDOR in semrush academyInsecure Direct Object Reference (IDOR) · medium
    49 votes
22. CORS misconfiguration which leads to the disclosure of certain data concerning the user.Improper Access Control - Generic · low
    46 votes
23. subdomain takeover at news-static.semrush.comImproper Access Control - Generic · high
    40 votes
24. Manipulation of exam results at Semrush.AcademyBusiness Logic Errors · medium
    38 votes
25. Password reset token leakage via refererViolation of Secure Design Principles · low
    38 votes
26. Improper input validation in projects leads to fully deny access to project resourcesImproper Input Validation · medium
    35 votes
27. Error Page Content Spoofing or Text Injection Violation of Secure Design Principles · low
    33 votes
28. Broken validation of user Id for JWT TokenBusiness Logic Errors · medium
    32 votes
29. Open RedirectOpen Redirect · low
    28 votes
30. Open redirect in semrush.comOpen Redirect · low
    26 votes
31. XSS Reflected on my_reportCross-site Scripting (XSS) - Reflected · low
    25 votes
32. Reflected XSS using Header InjectionCross-site Scripting (XSS) - Reflected · low
    25 votes
33. Code injection in https://www.semrush.comCode Injection · medium
    22 votes
34. Ad Builder Display Ads Path TraversalPath Traversal · medium
    22 votes
35. Content Injection on api.semrush.com to Reflected XSSCross-site Scripting (XSS) - Reflected · low
    16 votes
36. XSS on redirection page( Bypassed) Cross-site Scripting (XSS) - Reflected · low
    15 votes
37. php info file and sql backup at vendor's subdomainInformation Disclosure · low
    14 votes
38. protocol & Ports are not shown in third-party site redirect warning page Open Redirect · low
    14 votes
39. Reflected XSS on https://www.semrush.com/my_reports/externalSource/callback/googleAccountsGMBCross-site Scripting (XSS) - Reflected · low
    12 votes
40. Post Based XSS On Upload Via CK Editor [semrush.com]Cross-site Scripting (XSS) - Reflected · low
    12 votes
41. Following links are vulnerable to clickjackingUI Redressing (Clickjacking) · low
    12 votes
42. Single Sing On - ClickjackingUI Redressing (Clickjacking) · low
    11 votes