Bug bounty program

Udemy

Platform: HackerOne
Bounties: Pays
Assets in scope: 2
Disclosed reports: 37
Subdomains: 22,200

Most upvoted reports37

Most upvoted reports of Udemy
Report	Weakness	Disclosed	Bounty	Votes
Completed Compromise & Source Code Disclosure via Exposed Jenkins Dashboard at https://jenkins101.udemy.comAnalysed#182104	Command and Code Injection	2017-06-17	–	63
[affiliates.udemy.com] Wordpress user admin information discloureAnalysed#370777	Information Disclosure	2019-04-28	–	60
[engineering.udemy.com] - Subdomain Takeover (ghost.io)Analysed#368119	Access Control	2018-06-27	–	33
S3 bucket unnecessarily discloses permissionsAnalysed#330135	Access Control	2019-04-26	–	27
Subdomain Takeover (and Stored XSS) via Trailing Dot at https://coding-exercises.udemy.comAnalysed#223625	No weakness recorded	2018-05-10	–	19
Able to view others' gifts on /gift/share URL, giftId is predictable, and easy to manipulateAnalysed#119166	Authentication	2017-03-26	–	16
AWS S3 bucket writable for authenticated aws user#131468	Authentication	2017-01-05	–	13
Jenkins#181849	No weakness recorded	2017-01-10	–	13
CSRF in Udemy.com#109839	Cross-Site Request Forgery	2017-01-10	–	11
Ability to add pishing links in discusion ," Bypassing uneductional Links add "#62301	Information Disclosure	2016-07-09	–	10

Subdomains22,200

Root

udemy.com22,200

Scope:No domain scope published

Name suggests:Monitoring

First seen

Text fileClear filters0 names

No subdomain matches

Remove a filter or pick another root.

Clear filters

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.