Eternal · disclosed reports
Input Validation and Logic
10 disclosed reports · $4,350 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Eternal on HackerOne- reports
- 10
- valid
- 0
- paid a bounty
- 3
Every one of the 10 is a mark on the map. Named now: 1 to 10, most upvoted first.
- [www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s)
- [api.zomato.com] Able to manipulate order amount
- Add upto 10K rupees to a wallet by paying an arbitrary amount
- Able to manipulate order amount by removing cancellation amount and cause financial impact
- Availing Zomato gold by using a random third-party `wallet_id`
- Subdomain takeover of fr1.vpn.zomans.com
- [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business loss
- Attacker shall recieve order updates on whatsapp for users who have activated whatsapp notification
- Improper validation allows user to unlock Zomato Gold multiple times at the same restaurant within one day
- Mathematical error found in meals for one
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data. Use this via MCP