POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter Analysed #382321 Valid Cross-site Scripting Medium 2018-09-18 – 16 Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leaked Analysed #1514356 Valid Information Disclosure High 2022-05-01 – 18 [critical] sql injection by GET method Analysed #319279 Valid SQL Injection High 2018-03-06 – 22 EMAIL SPOOFING Analysed #496360 Valid Access Control Medium 2022-01-02 – 22 Access to alerta.khanacademy.org leak sensitive data Analysed #1061664 Valid Access Control Critical 2021-09-08 – 29 Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.org Analysed #474798 Valid Access Control High 2019-08-25 – 30 Login page vulnerable to bruteforce attacks via rate limiting bypass Analysed #1040471 Valid Authentication Low 2021-01-09 – 34 xss due to incorrect handling of postmessages Analysed #1758132 Valid Cross-site Scripting Critical 2022-12-23 – 35 S3 bucket takeover [learn2.khanacademy.org] Analysed #1777077 Valid No weakness recorded High 2022-12-29 – 35 Enumerate all the class codes via google dorking Analysed #1210043 Valid Access Control High 2021-07-22 – 44 Account takeover by changing email Analysed #538800 Valid Cross-Site Request Forgery Critical 2019-05-17 – 80 Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag. Analysed #2234420 Valid Misconfiguration and Insecure Design Low 2023-12-22 – 83 337k users and 1 employee leaked credentials Analysed #3250691 Valid Information Disclosure High 2025-09-10 – 87 Leaked reused password for a few Khan Academy users Analysed #3099978 Valid Cryptography High 2025-07-12 – 92 Unauthorized Account Access via Leaked Credentials in URL Format (Account Takeover ) Analysed #3080597 Valid Cryptography Critical 2025-05-07 – 107 Cross-Site Request Forgery (CSRF) vulnerability on API endpoint allows account takeovers Analysed #419891 Valid Cross-Site Request Forgery High 2019-06-22 – 111 1-Click Account Takeover via Open Redirect through Regex Bypass in Domain Validation Analysed #3723458 Valid Access Control Critical 2026-06-20 – 126 Take over of accounts created using Google or Facebook Analysed #442901 Valid Cross-Site Request Forgery Critical 2019-05-17 – 184