Skip to content
BackEsc
Sign in

Eternal · disclosed reports

SQL Injection

11 disclosed reports · $15,600 paid

Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.

Open Eternal on HackerOne
reports
11
paid a bounty
10

Every one of the 11 is a mark on the map. Named now: 1 to 11, most upvoted first.

  1. [www.zomato.com] SQLi - /php/██████████ - item_id#403616Eternal · $4,500 · 326 votes
  2. Solr Injection in `user_id` parameter at :/v2/leaderboard_v2.json#952501Eternal · $2,000 · 137 votes
  3. [https://reviews.zomato.com] Time Based SQL Injection#300176Eternal · $1,000 · 72 votes
  4. [www.zomato.com] Blind SQL Injection in /php/geto2banner#838855Eternal · $2,000 · 68 votes
  5. [www.zomato.com] SQLi on `order_id` parameter#358669Eternal · $1,000 · 63 votes
  6. [www.zomato.com] Union SQLi + Waf Bypass#258582Eternal · $1,000 · 61 votes
  7. [www.zomato.com] Blind SQL Injection in /php/widgets_handler.php#836079Eternal · $2,000 · 54 votes
  8. [www.zomato.com] Boolean SQLi - /█████.php#297534Eternal · $1,000 · 41 votes
  9. [www.zomato.com] Boolean SQLi - /███████.php#301257Eternal · $1,000 · 35 votes
  10. SQL Injection, exploitable in boolean mode#246412Eternal · 20 votes
  11. [www.zomato.com] Abusing LocalParams (city) to Inject SOLR query#844428Eternal · $100 · 11 votes

paid a bounty

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in