Typical CS dude checking his Georgia Tech admission 3 hours early

Hope for him that it's not just one variant of the payload that gets hidden / shown based on the backend response.

When I was in university we had a page you could go to and see your grades which were released after a certain date. It also showed your cumulative GPA to two decimal places which oddly was not embargoed so, you could plausibly back-solve to figure out what your grades were. In my case I thought I had failed a class somehow because my GPA took a hit, turns out they had mistakenly left me registered class I withdrew from, which I cleared up.

Harvard had a similar bug - you could modify the url to find out if you had entry. They found out and revoked admission from all students who used the url on ethics violations.

Knows about inspect element but doesn't know how to take a screenshot?

It would be funny if both scenarios were present in the HTML and the decision decided which text showed up at the proper time.

Back 20-ish years ago when NIS+ was used to federate ssh logins on multiple *NIX clusters at some CS department that shall remain nameless:

    getent passwd | awk | johntheripper

Say "hello" to trivial plaintext passwords of 6 tenured profs, a dozen associate profs, and 30+ students in a few minutes and without rainbow tables. (There was no ill-intent involved and the unfortunate parties were notified indirectly.) The flaw was giving everyone access to unsalted crypt password hashes. Exploring systems today would likely result in an instant Aaron Swartz-style crucifixion because of the cult of "zero tolerance" equals zero justice and zero proportionality because curiosity must be immediately murdered by the "culture of 'no'".

CFAA charges being filed as we speak.

In college I found all the CS final exams in a hidden folder structure on the urls

Supreme in the bookmark bar? Cringe