A while back I looked into blackboard and did some light black box security testing on a demo app. From what I remember it was like Swiss cheese. Ultimately I stopped looking because they didn’t seem too interested. Some of the good ones I found were arbitrary file I/O issues, a few IDOR related problems as well. None of this surprises me.