Escaping the iframe via exceptions #103989 Valid Cross-site Scripting – 2015-12-29 – – Frameset(Frame) html tag is allowed in html editor.(can lead to clickjacking) #285609 Valid Misconfiguration and Insecure Design Low 2018-02-14 – 1 https://www.khanacademy.org/login open-redirect #6357 Valid Open Redirect – 2014-04-09 – 3 Full Path Disclosure on [smarthistory.khanacademy.org] #6362 Valid Information Disclosure – 2014-04-11 – 3 https://www.khanacademy.org/coach/reports/activity XSS #6409 Valid Cross-site Scripting – 2014-04-09 – 3 Suffix of url-path is vulnerable to XSS-attack #13285 Valid Cross-site Scripting – 2014-09-16 – 3 XSS vulnerability in "/coach/roster/" ( create your first class) #111763 Valid Cross-site Scripting – 2016-02-12 – 3 http://smarthistory.khanacademy.org/search-results.html XSS #6344 Valid Cross-site Scripting – 2014-04-09 – 4 Dom based XSS https://www.khanacademy.org/ #6352 Valid Cross-site Scripting – 2014-04-09 – 4 Stored XSS {dangerous?} https://www.khanacademy.org/coach/roster/?listId=allStudents #6369 Valid Cross-site Scripting – 2014-04-09 – 4 Lighttpd version disclosure / directory listing #6371 Valid Information Disclosure – 2014-04-12 – 4 Sql injection And XSS #31023 Valid Cross-site Scripting – 2015-12-08 – 4 Persistent class XSS [the fuck] #6412 Valid Cross-site Scripting – 2014-04-09 – 5 Open Redirection in SmartHistory KhanAcademy #6564 Valid Open Redirect – 2014-04-09 – 5 Html injection on khanacademy #83604 Valid Command and Code Injection – 2015-12-14 – 5 The web app's forgot password page is vulnerable to text injection/content spoofing #159213 Valid Command and Code Injection – 2017-03-01 – 6 Possible to join any class without coache's knowledge & Little Information Disclosure #266090 Valid Input Validation and Logic Medium 2017-10-12 – 6 XSS at http://smarthistory.khanacademy.org #6575 Valid Cross-site Scripting – 2014-04-09 – 7 Khan Academy ClickJacking to Steal Users's Credintials #639682 Valid No weakness recorded – 2021-03-31 – 7 XSS through document projects #244902 Valid Cross-site Scripting High 2018-03-30 – 9 CSRF token fixation and potential account takeover #308394 Valid Misconfiguration and Insecure Design Medium 2018-04-19 – 9 Possible Subdomain Takeover #399165 Valid No weakness recorded Medium 2018-08-31 – 9 Possible Take Over Subdomain For Inbound Emails #403822 Valid No weakness recorded Medium 2018-11-08 – 9 Cross site scripting (content-sniffing) #438953 Valid Cross-site Scripting Medium 2018-12-08 – 9 Unauthorised Account Detail Modification #868146 Valid Access Control High 2020-06-19 – 9 Weak Ciphers Enabled #6488 Valid Information Disclosure – 2014-04-09 – 10 Password authentication when changing information bypass. Bypass of report #721341 #1040373 Valid Authentication High 2021-02-11 – 11 https://mathfacts.khanacademy.org/ includes code from unprivileged localhost port #331752 Valid Command and Code Injection Medium 2019-05-25 – 12 CSV Injection Via Student Password/Name Leads To Client Side RCE And Reading Client Files #943255 Valid Command and Code Injection Medium 2020-08-27 – 12 Bypass the fix of report #1078283 due to poor validation Analysed #1212337 Valid Open Redirect High 2021-07-08 – 14 POST XSS in https://www.khanacademy.org.tr/ via page_search_query parameter Analysed #382321 Valid Cross-site Scripting Medium 2018-09-18 – 16 The endpoint /api/internal/graphql/requestAuthEmail on Khanacademy.or is vulnerable to Race Condition Attack. Analysed #1293377 Valid Input Validation and Logic Medium 2022-03-22 – 17 OPEN URL REDIRECT through PNG files Analysed #163272 Valid Cross-site Scripting Medium 2017-02-17 – 18 Enumerate class codes via yahoo dork - Can access any course under teacher - Sensitive information leaked Analysed #1514356 Valid Information Disclosure High 2022-05-01 – 18 Sensitive information/action is stored/done is done using a GET request Analysed #163820 Valid Cross-Site Request Forgery – 2019-06-23 – 20 [critical] sql injection by GET method Analysed #319279 Valid SQL Injection High 2018-03-06 – 22 EMAIL SPOOFING Analysed #496360 Valid Access Control Medium 2022-01-02 – 22 Information can be changed without a password Analysed #721341 Valid Authentication High 2020-03-14 – 24 Client Side string length check Analysed #1244798 Valid Input Validation and Logic Medium 2023-10-14 – 25 Access to alerta.khanacademy.org leak sensitive data Analysed #1061664 Valid Access Control Critical 2021-09-08 – 29 Subdomain takeover on healthyhackathon.khanacademy.org and hackweek.khanacademy.org Analysed #474798 Valid Access Control High 2019-08-25 – 30 Client-Side Denial of Service (DoS) via Memory Exhaustion on Password Reset Endpoint Analysed #3987499 Valid Denial of Service High 2026-10-05 – 32 Login page vulnerable to bruteforce attacks via rate limiting bypass Analysed #1040471 Valid Authentication Low 2021-01-09 – 34 xss due to incorrect handling of postmessages Analysed #1758132 Valid Cross-site Scripting Critical 2022-12-23 – 35 S3 bucket takeover [learn2.khanacademy.org] Analysed #1777077 Valid No weakness recorded High 2022-12-29 – 35 Email Verification Bypass Allows Users to Add & verify Any Email As Guardians Email Analysed #1636552 Valid Access Control High 2022-12-17 – 42 Enumerate all the class codes via google dorking Analysed #1210043 Valid Access Control High 2021-07-22 – 44 Account takeover by changing email Analysed #538800 Valid Cross-Site Request Forgery Critical 2019-05-17 – 80 Text Injection/ Content Spoofing on https://cloud.e.khanacademy.org by breaking out of input tag. Analysed #2234420 Valid Misconfiguration and Insecure Design Low 2023-12-22 – 83 XSS on using the legacy "Graphie To Png" API Analysed #2846011 Valid Cross-site Scripting Critical 2025-02-06 – 86