I am following an online class from a local institution. Recently, I've noticed they don't crypt passwords because they sent me my password by e-mail in clear text.
The website has a lot of personal information so I've decided to test how secure it is.
After a few minutes of testing the private message system, I've found out that you can view, delete, reply to any message with any username. Also, they sent a message to everyone with their password recently so I can see everyone's password. Obviously, XSS attacks are possible too.
I've reported the vulnerabilities and it still hasn't been patched (it's only been a week but if I was responsible of a system like this, I wouldn't sleep until everything's fixed).
How can I make them secure their website properly? My own personal information is also at risk here?
(To make sure there are no more answers related to that, I am well-aware of the laws. It doesn't change the fact that some day, someone will do exactly what I did but with bad intentions.)