Browse / Udemy

Udemy

See its reports on the map

Attack surface: 22,200 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Udemy

• Cross-site Scripting9
• Information Disclosure5
• Authentication5
• Cross-Site Request Forgery5
• Misconfiguration5
• Access Control3

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.comCode Injection · high
   63 votes
2. [affiliates.udemy.com] Wordpress user admin information discloureInformation Disclosure · low
   60 votes
3. [engineering.udemy.com] - Subdomain Takeover (ghost.io)Improper Access Control - Generic · low
   33 votes
4. S3 bucket unnecessarily discloses permissionsImproper Access Control - Generic
   27 votes
5. Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.comCross-site Scripting (XSS) - Stored
   19 votes
6. Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulateImproper Authentication - Generic
   16 votes
7. Jenkinshigh
   13 votes
8. AWS S3 bucket writable for authenticated aws userImproper Authentication - Generic
   13 votes
9. Ability to add pishing links in discusion ," Bypassing uneductional Links add "Information Disclosure
   10 votes
10. Subdomain Takeover at Landing.udemy.com Privilege Escalation · low
    9 votes
11. teach.udemy.com log poison vulnerability through wordpress debug.log being publically availableCode Injection
    8 votes
12. Extremely high Course rating values could be set in order to make really high Average rating of the course. Negative values could be set to.Violation of Secure Design Principles
    5 votes
13. Content Spoofing in udemyViolation of Secure Design Principles · low
    4 votes
14. Authentication Data are not Clearing Improper Authentication - Generic
    4 votes
15. XSS VulnerabilityCross-site Scripting (XSS) - Generic
    3 votes
16. XSS on https://www.udemy.com/asset/export.htmlCross-site Scripting (XSS) - Generic
    3 votes
17. xss profileCross-site Scripting (XSS) - Generic
    3 votes
18. Multiple sub domain are vulnerable because of leaking full path Information Disclosure
    2 votes
19. leak receipt of another userInformation Disclosure
    2 votes
20. information disclosureInformation Disclosure
    1 votes
21. xss on autoserchCross-site Scripting (XSS) - Generic
    1 votes