Session Cookie Leakage via Static Header Field in WebViewerFragment Analysed #3475626 Valid Misconfiguration and Insecure Design High 2026-03-17 – 131 Unauthorized User can View Subscribers of Other Users Newsletters Analysed #1716300 Valid Insecure Direct Object Reference High 2023-03-29 – 117 Previous commentor on post can still comment even after comment permission is changed to disabled Analysed #3151001 Valid Access Control Low 2026-02-03 – 112 Unauthorized access to resumes stored on LinkedIn Analysed #1777095 Valid Insecure Direct Object Reference High 2022-12-07 – 112 HTML Injection in LinkedIn Premium Support Chat Analysed #3079966 Valid No weakness recorded Low 2025-05-07 – 102 Improper Access Control - Access to "Active Hiring" (Premium feature) filter results Analysed #3235855 Valid Access Control Medium 2026-02-03 – 100 IDOR allows an attacker to delete anyone's featured photo. Analysed #1608735 Valid Insecure Direct Object Reference Medium 2023-08-24 – 99 An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users. Analysed #2291999 Valid Insecure Direct Object Reference High 2024-03-12 – 94 Stored XSS on LinkedIn App via iframe tag in Article Analysed #2212950 Valid Cross-site Scripting Critical 2024-02-28 – 93 Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per month Analysed #1808719 Valid Insecure Direct Object Reference High 2023-08-24 – 84 Information disclosure by sending a GIF Analysed #1801427 Valid Input Validation and Logic Medium 2023-04-28 – 84 Entire database of emails exposed through URN injection Analysed #1806939 Valid Command and Code Injection Medium 2023-05-22 – 79 Access to Deactivated LinkedIn Company Pages via Competitor Analytics API Analysed #3604288 Valid Insecure Direct Object Reference Medium 2026-03-24 – 77 Can access the job name, creator name and can report any draft/under review/rejected job Analysed #1581528 Valid Insecure Direct Object Reference Medium 2022-07-20 – 65 Users can access exams in course without having to subscribe to PREMIUM Analysed #1892888 Valid Access Control Medium 2024-01-10 – 64 Blocking a company page admin prevents him from delete paid media admin or edit his roles Analysed #2339192 Valid Access Control Medium 2026-03-05 – 55 Html injection in event Description Analysed #2215418 Valid Input Validation and Logic Low 2024-01-29 – 55 IDOR - Delete technical skill assessment result & Gained Badges result of any user Analysed #1592587 Valid No weakness recorded Medium 2022-10-05 – 48 Privilege Escalation - "Analyst" Role Can View Email Domains of a Company - [GET /voyager/api/voyagerOrganizationDashEmailDomainMappings] Analysed #1572591 Valid Access Control Medium 2022-08-26 – 48 CSRF that makes any user send invitations to the attacker by simply clicking on a link. Analysed #1961163 Valid Cross-Site Request Forgery Medium 2023-12-06 – 41 An Attacker Can Flag Draft Job Posts And Can Disclose The Draft Job Posts Details [ Similar to #1581528 Resolved Report] Analysed #1675674 Valid Input Validation and Logic Medium 2023-08-24 – 34