Bug bounty program
CO
Coursera
Most upvoted reports6
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| XSS StoredAnalysed#205626 | Cross-site Scripting | 2018-01-12 | – | 28 |
| No Password Verification on Changing Email Address Cause Account takeoverAnalysed#292673 | Misconfiguration and Insecure Design | 2018-05-19 | – | 21 |
| Broken authentication and session management flaw#152080 | Authentication | 2016-08-18 | – | 15 |
| [www.coursera.org] Leaking password reset link on referrer header#303322 | Misconfiguration and Insecure Design | 2018-02-14 | – | 9 |
| XSS in https://www.coursera.org/courses/#127163 | Cross-site Scripting | 2016-09-14 | – | 5 |
| Stored XSS via transloadit.com and imageproxy#216822 | Cross-site Scripting | 2017-11-30 | – | 5 |
Subdomains309
| Name | Scope | First seen |
|---|---|---|
| jira.coursera.orgtools | Not in the scope | 2026-11-14 |
1 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.