This question already has an answer here:
I've encountered a security vulnerability in a website. The website is that of a leading brand in it's industry. There are user accounts etc. and this website is very popular.
I've contact multiple people from their development/IT team, but no reply (they've read the message).
Do I leave it as it is? Knowing that the public are potentially at risk by using a site that is less than secure?
Is this what filing a CVS/CVE issue is for? Or does that not fit into this at all and I should leave things as they are?