HexBrain
Sign in

Browse / Eternal

Eternal

128disclosed reports
$37,600paid in bounties

See its reports on the map

What gets reported to Eternal

Most upvoted reports

AllValidInformativeN/ADuplicate

  1. Stealing Zomato X-Access-Token: in Bulk using HTTP Request Smuggling on api.zomato.comHTTP Request Smuggling · critical
    559 votes
  2. [www.zomato.com] SQLi - /php/██████████ - item_idSQL Injection · critical
    $4,500326 votes
  3. Improper Validation at Partners LoginImproper Authentication - Generic · critical
    $2,000251 votes
  4. [www.zomato.com] CORS Misconfiguration, could lead to disclosure of sensitive informationMisconfiguration · medium
    $550246 votes
  5. SQL Injection in www.hyperpure.comCode Injection · critical
    $2,000229 votes
  6. [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s) Business Logic Errors · medium
    229 votes
  7. [www.zomato.com] Blind XSS on one of the Admin DashboardCross-site Scripting (XSS) - Generic · high
    $750221 votes
  8. Information Disclosure through Sentry Instance ███████Information Exposure Through Debug Information · high
    $750178 votes
  9. Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.jsonSQL Injection · critical
    $2,000137 votes
  10. [api.zomato.com] Able to manipulate order amountBusiness Logic Errors · high
    136 votes
  11. Add upto 10K rupees to a wallet by paying an arbitrary amountBusiness Logic Errors · high
    $2,000132 votes
  12. Able to manipulate order amount by removing cancellation amount and cause financial impactBusiness Logic Errors · high
    130 votes
  13. Availing Zomato gold by using a random third-party `wallet_id`Business Logic Errors · critical
    $2,000116 votes
  14. [Zomato Order] Insecure deeplink leads to sensitive information disclosureInformation Disclosure · high
    $750114 votes
  15. [www.zomato.com] Leaking Email Addresses of merchants via reset password featureImproper Access Control - Generic
    113 votes
  16. Claiming the listing of a non-delivery restaurant through OTP manipulationImproper Authorization · critical
    $3,250108 votes
  17. Login to any account with the emailaddressImproper Authentication - Generic · high
    $1,000103 votes
  18. [www.zomato.com] Blind XSS in one of the admin dashboardCross-site Scripting (XSS) - Generic · high
    $500102 votes
  19. Subdomain takeover of fr1.vpn.zomans.comBusiness Logic Errors · medium
    $35099 votes
  20. Base alpha version code exposureInformation Disclosure
    99 votes
  21. credentials leakage in public lead to view dev websites Information Disclosure · low
    78 votes
  22. [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business lossBusiness Logic Errors · high
    78 votes
  23. Page has a link to google drive which has logos and a few customer phone recordingsCleartext Storage of Sensitive Information · medium
    $20076 votes
  24. [https://reviews.zomato.com] Time Based SQL InjectionSQL Injection · critical
    $1,00072 votes
  25. [www.zomato.com] Blind SQL Injection in /php/geto2bannerSQL Injection · critical
    $2,00068 votes
  26. [Zomato Android/iOS] Theft of user sessionImproper Authentication - Generic
    68 votes
  27. IDOR to delete images from other storesInsecure Direct Object Reference (IDOR) · low
    $60067 votes
  28. [www.zomato.com] SQLi on `order_id` parameterSQL Injection · critical
    $1,00063 votes
  29. subdomain takeover on fddkim.zomato.comPrivilege Escalation · medium
    61 votes
  30. [www.zomato.com] Blind XSS in one of the Admin DashboardCross-site Scripting (XSS) - Stored
    61 votes
  31. [www.zomato.com] Union SQLi + Waf BypassSQL Injection
    $1,00061 votes
  32. Open AWS S3 bucket leaks all Images uploaded to Zomato chatImproper Authentication - Generic · medium
    57 votes
  33. [www.zomato.com] Blind SQL Injection in /php/widgets_handler.phpSQL Injection · critical
    $2,00054 votes
  34. [Zomato for Business Android] Vulnerability in exported activity WebViewmedium
    52 votes
  35. [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect ProviderCross-site Scripting (XSS) - Reflected · medium
    51 votes
  36. Race condition in User comments LikesViolation of Secure Design Principles · low
    45 votes
  37. Blind XSS - Report review - Admin panelCross-site Scripting (XSS) - Stored · medium
    $35041 votes
  38. [www.zomato.com] Boolean SQLi - /█████.phpSQL Injection
    $1,00041 votes
  39. IDOR to cancel any table booking and leak sensitive information such as email,mobile number,uuidInsecure Direct Object Reference (IDOR) · high
    $25041 votes
  40. Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notificationBusiness Logic Errors · medium
    37 votes
  41. [www.zomato.com] Boolean SQLi - /███████.phpSQL Injection
    $1,00035 votes
  42. [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD MemberImproper Access Control - Generic · medium
    34 votes
  43. [www.zomato.com] IDOR - Leaking all Personal Details of all Zomato Users through an endpointInsecure Direct Object Reference (IDOR) · high
    33 votes
  44. SSRF in https://www.zomato.com████ allows reading local files and website source codeServer-Side Request Forgery (SSRF) · critical
    32 votes
  45. Unauthorised Access to Anyone's User AccountImproper Authentication - Generic · critical
    32 votes
  46. Self-Stored XSS - Chained with login/logout CSRFCross-site Scripting (XSS) - Stored · medium
    $30031 votes
  47. Admin Access to a domain used for development and admin access to internal dashboards on that domainImproper Access Control - Generic
    31 votes
  48. CORS Misconfiguration on www.zomato.comMisconfiguration
    31 votes
  49. Possible to enumerate Addresses of users using AddressId and guessing the delivery_subzoneInsecure Direct Object Reference (IDOR) · medium
    $1,50029 votes
  50. [█████████] Hardcoded credentials in Android AppUse of Hard-coded Credentials · critical
    $50028 votes
  51. HTML injection leads to reflected XSSCode Injection · low
    $15026 votes
  52. [www.zomato.com] Privilege Escalation - /php/restaurant_menus_handler.phpPrivilege Escalation
    $20026 votes
  53. Use any User to Follow you (Increase Followers) [IDOR]Insecure Direct Object Reference (IDOR) · low
    $5025 votes
  54. Reflected XSS on developers.zomato.comCross-site Scripting (XSS) - Reflected · low
    $10023 votes
  55. [www.zomato.com] Abusing LocalParams to Inject Code through ███████ queryhigh
    23 votes
  56. Improper validation allows user to unlock Zomato Gold multiple times at the same restaurant within one dayBusiness Logic Errors · low
    22 votes
  57. Length extension attack leading to HTML injectionCryptographic Issues - Generic · medium
    $10022 votes
  58. Ability to manipulate price with a max threshold of `<1 Rupee` in support rider parameterViolation of Secure Design Principles · low
    21 votes
  59. [www.zomato.com] IDOR - Gold Subscription Details, Able to view "Membership ID" and "Validity Details" of other UsersInsecure Direct Object Reference (IDOR) · low
    $10021 votes
  60. [www.zomato.com] IDOR - Delete/Deactivate any special menu of any Restaurants from ZomatoInsecure Direct Object Reference (IDOR)
    21 votes
  61. [www.zomato.com] Unauthenticated access to Internal Sales Data of Zomato through an unrestricted endpointImproper Authentication - Generic
    21 votes
  62. SQL Injection, exploitable in boolean modeSQL Injection · critical
    20 votes
  63. Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)Information Disclosure
    19 votes
  64. [www.zomato.com] Privilege Escalation - Control reviews - /████dashboard_handler.phpPrivilege Escalation
    $30018 votes
  65. Amazon S3 bucket misconfiguration (share)Improper Access Control - Generic
    18 votes
  66. [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php**Insecure Direct Object Reference (IDOR)
    17 votes
  67. HTML Injection @ /[restaurant]/order endpoint.Cross-site Scripting (XSS) - Generic · low
    $15015 votes
  68. Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteServiceInformation Disclosure · low
    $30015 votes
  69. User Profiles Leak PII in HTML Document for Mobile Browser User AgentsPrivacy Violation · medium
    $50015 votes
  70. Restaurant payment information leakageBusiness Logic Errors · critical
    15 votes
  71. Posting to Twitter CSRF on php/post_twitter_authenticate.phpCross-Site Request Forgery (CSRF) · low
    $5015 votes
  72. test.zba.se is vulnerable to SSL POODLE Cryptographic Issues - Generic · medium
    15 votes
  73. takeover a lot of accountshigh
    15 votes
  74. Reflected XSS on https://www.zomato.comCross-site Scripting (XSS) - Reflected · medium
    14 votes
  75. Bypass OTP verification when placing OrderImproper Authentication - Generic
    14 votes
  76. Zomato.com Reflected Cross Site ScriptingCross-site Scripting (XSS) - Reflected · low
    $10013 votes
  77. Unauthorized update of merchants' information via /php/merchant_details.phpImproper Access Control - Generic · high
    13 votes
  78. Bypass OTP verification when placing OrderImproper Access Control - Generic · high
    13 votes
  79. Potential server misconfiguration leads to disclosure of vendor/ directoryForced Browsing · medium
    12 votes
  80. [www.zomato.com] Abusing LocalParams (city) to Inject SOLR querySQL Injection · low
    $10011 votes
  81. [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2Cross-site Scripting (XSS) - Reflected · low
    $10011 votes
  82. IDOR in treat subscriptionsInsecure Direct Object Reference (IDOR) · medium
    11 votes
  83. Reflected XSS on business-blog.zomato.com - Part ICross-site Scripting (XSS) - Generic
    10 votes
  84. XSS onmouseover Cross-site Scripting (XSS) - Generic
    9 votes
  85. Twitter Disconnect CSRFCross-Site Request Forgery (CSRF)
    9 votes
  86. [api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR queryFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) · low
    $1508 votes
  87. CSRF in the "Add restaurant picture" functionCross-Site Request Forgery (CSRF)
    $508 votes
  88. Reflected XSS in Zomato Mobile - category parameterCross-site Scripting (XSS) - Reflected · medium
    7 votes
  89. [www.zomato.com] Getting a complimentary dessert [Zomato Treats] on ordering a Meal at no costmedium
    6 votes
  90. Outdated MediaElement.js Reflected Cross-Site Scripting (XSS)Cross-site Scripting (XSS) - Generic
    6 votes
  91. CSRF To Like/Unlike PhotosCross-Site Request Forgery (CSRF) · medium
    5 votes
  92. Reflected XSS on business-blog.zomato.com - Part 2Cross-site Scripting (XSS) - Generic
    5 votes
  93. Several XSS affecting Zomato.com and developers.zomato.comCross-site Scripting (XSS) - Generic
    5 votes
  94. CSRF AT INVITING PEOPLE THOUGH PHONE NUMBERViolation of Secure Design Principles
    5 votes
  95. CSRF AT SELECTING ZAMATO HANDLECross-Site Request Forgery (CSRF)
    5 votes
  96. xss found in zomatoCross-site Scripting (XSS) - DOM · medium
    4 votes
  97. MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS)Cross-site Scripting (XSS) - Generic · high
    4 votes
  98. XSS in flashmediaelement.swf (business-blog.zomato.com)Cross-site Scripting (XSS) - Generic · medium
    4 votes
  99. Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relayCross-site Scripting (XSS) - Generic
    4 votes
  100. Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration FlowImproper Authentication - Generic
    4 votes