Case 4 — Brand24 (partner asset)

Asset: app.brand24.com — Other Semrush Related Asset (acquisition). Public page to enter a project name.

Public list (names are escaped here):

#	name (escaped)
0	<img src=x onerror="document.body.insertAdjacentHTML('afterbegin','<div style=background:#d94f2a;color:#fff;padding:10px;font:bold 15px sans-serif>XSS executed by dompit as '+document.domain+'</div>')">

Internal employee panel: /brand24/cms33/

Triage questions: where exactly does the payload execute — on the public page or only in the internal CMS? Who are the victims (external users or only employees)? Is this the main semrush.com or a secondary acquired asset? How does that affect severity versus the claimed High?

H1 Triage Range - training mock. All data, keys and emails are fictional. Fetch and external APIs are simulated. ← home