Browse / Udemy

Udemy

See its reports on the map

Attack surface: 22,200 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Udemy

• Cross-site Scripting9
• Information Disclosure5
• Authentication5
• Cross-Site Request Forgery5
• Misconfiguration5
• Access Control3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. CSRF in Udemy.com InformativeCross-Site Request Forgery (CSRF)
   11 votes
2. No password length restrictionInformativeWeak Cryptography for Passwords
   4 votes
3. Critical : Malware and XSS file can be uploaded and executed on udemyInformativeCross-site Scripting (XSS) - Generic
   3 votes
4. Csrf on creating courseInformativeCross-Site Request Forgery (CSRF)
   3 votes
5. Showing Up Source CodeInformative
   3 votes
6. Misconfigured SPF Record FlagInformativeViolation of Secure Design Principles
   3 votes
7. sweet32 InformativeCryptographic Issues - Generic
   2 votes
8. Reflected XSS and/or malicious redirection via JWPlayer 6 configuration modificationInformativeCross-site Scripting (XSS) - Generic
   2 votes
9. CSRF TokenInformativeCross-Site Request Forgery (CSRF)
   1 votes
10. Violation of secure design principleInformativeViolation of Secure Design Principles
    1 votes
11. Weak PasswordInformativeViolation of Secure Design Principles
    1 votes
12. CSRF Token Design FlawInformativeCross-Site Request Forgery (CSRF)
    1 votes
13. Udemy s3 storage can be used by an attacker personal website because of missing CSRF TokenInformativeCross-Site Request Forgery (CSRF)
    1 votes
14. Stored XSSInformativeCross-site Scripting (XSS) - Generic