[is_true]

Try to contact them and offer to fix the errors.

I did something like this and when I reported the URL with the vulnerability they didn't answer, but when I tried to access that URL I got a page that said "the bug is in uranus". Unfortunately if you added any parameter to that URL the admin panel was still public.

[throwaway3DN]

That's exactly the kind of childish answer I'd like to avoid if I disclose the security vulnerability ;-)