LinkedIn

LinkedIn 的公开漏洞报告、类别分布与常见资产。

攻击面

弱点类别分布

• 不安全的直接对象引用12
• 访问控制10
• 其他弱点6
• 业务逻辑4
• 身份认证4
• 信息泄露3
• 跨站请求伪造2
• 错误配置1
• 代码执行1
• 跨站脚本1

主要弱点

• IDOR12
• 访问控制缺陷（通用）8
• Unlabeled5
• 信息泄露3
• 业务逻辑错误2
• 认证缺陷（通用）2
• 权限提升2
• 跨站请求伪造2
• Unlabeled1
• Client-Side Enforcement of Server-Side Security1

常见资产

• www.linkedin.comURL · 39
• · 3
• com.linkedin.androidGOOGLE_PLAY_APP_ID · 2

高票报告

当前状态 40 份 · 全部 44

1. 156
   Can delete other user's post and company page post访问控制 · 2023-04-11 · 未评级
   $0访问控制缺陷（通用）
2. 131
   Session Cookie Leakage via Static Header Field in WebViewerFragment错误配置 · 2026-03-17 · 高危
   $0错误配置
3. 117
   Unauthorized User can View Subscribers of Other Users Newsletters不安全的直接对象引用 · 2023-03-29 · 高危
   $0IDOR
4. 112
   Previous commentor on post can still comment even after comment permission is changed to disabled访问控制 · 2026-02-03 · 低危
   $0访问控制缺陷（通用）
5. 112
   Unauthorized access to resumes stored on LinkedIn不安全的直接对象引用 · 2022-12-08 · 高危
   $0IDOR
6. 111
   Can see phone numbers of others by providing mail address信息泄露 · 2024-11-14 · 高危
   $0信息泄露
7. 102
   HTML Injection in LinkedIn Premium Support Chat其他弱点 · 2025-05-07 · 低危
   $0Unlabeled
8. 100
   Improper Access Control - Access to "Active Hiring" (Premium feature) filter results访问控制 · 2026-02-03 · 中危
   $0访问控制缺陷（通用）
9. 99
   IDOR allows an attacker to delete anyone's featured photo.不安全的直接对象引用 · 2023-08-24 · 中危
   $0IDOR
10. 94
    An attacker can submit arbitrary projects to their service accounts and obtain full information on projects of other users.不安全的直接对象引用 · 2024-03-12 · 高危
    $0IDOR
11. 93
    Stored XSS on LinkedIn App via iframe tag in Article跨站脚本 · 2024-02-28 · 严重
    $0存储型 XSS
12. 87
    IDOR to make someone attend or leave an event不安全的直接对象引用 · 2026-03-06 · 中危
    $0IDOR
13. 84
    Attackers can use TRIAL Premium only by paying **IDR 10,000.00** from the original price of `IDR462,400.00` per month不安全的直接对象引用 · 2023-08-24 · 高危
    $0IDOR
14. 84
    Information disclosure by sending a GIF业务逻辑 · 2023-04-29 · 中危
    $0Client-Side Enforcement of Server-Side Security
15. 79
    Forced OAuth authorization using button ID in hash and holding space身份认证 · 2024-12-17 · 中危
    $0认证缺陷（通用）
16. 79
    Entire database of emails exposed through URN injection代码执行 · 2023-05-23 · 中危
    $0代码注入
17. 77
    Access to Deactivated LinkedIn Company Pages via Competitor Analytics API不安全的直接对象引用 · 2026-03-24 · 中危
    $0IDOR
18. 77
    Employee-only Area Bypass访问控制 · 2024-02-19 · 中危
    $0访问控制缺陷（通用）
19. 70
    Attackers can *Upgrade and claim offer* on the Premium Trial Subscription with a total price of *IDR0.00* from the original *IDR7,022,061.82*业务逻辑 · 2024-06-19 · 高危
    $0业务逻辑错误
20. 65
    Can access the job name, creator name and can report any draft/under review/rejected job不安全的直接对象引用 · 2022-07-21 · 中危
    $0IDOR
21. 64
    Users can access exams in course without having to subscribe to PREMIUM访问控制 · 2024-01-11 · 中危
    $0访问控制缺陷（通用）
22. 57
    User Details Can Be Disclosed Even If The Account IS In Hibernation State信息泄露 · 2023-12-07 · 低危
    $0信息泄露
23. 55
    Blocking a company page admin prevents him from delete paid media admin or edit his roles访问控制 · 2026-03-06 · 中危
    $0访问控制缺陷（通用）
24. 55
    Html injection in event Description其他弱点 · 2024-01-29 · 低危
    $0输入校验不当
25. 53
    CSRF that makes any linkedin user follow attacker controlled accounts by simply clicking https://www.linkedin.com/comm/mynetwork/discovery-see-all/*跨站请求伪造 · 2023-12-07 · 中危
    $0跨站请求伪造