Eternal · disclosed reports
Cross-site Scripting
31 disclosed reports · $2,350 paid · 30 valid · 1 duplicate
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. A report opens its page here: our analysis where there is one, and the link to HackerOne. The status is HackerOne's own outcome; "access needed" is only what a title states.
Open Eternal on HackerOne- reports
- 31
- valid
- 30
- paid a bounty
- 8
Every one of the 31 is a mark on the map. Named now: 1 to 26, most upvoted first.
- [www.zomato.com] Blind XSS on one of the Admin Dashboard
- [www.zomato.com] Blind XSS in one of the admin dashboard
- [www.zomato.com] Blind XSS in one of the Admin Dashboard
- [auth2.zomato.com] Reflected XSS at `oauth2/fallbacks/error` | ORY Hydra an OAuth 2.0 and OpenID Connect Provider
- Blind XSS - Report review - Admin panel
- Self-Stored XSS - Chained with login/logout CSRF
- Reflected XSS on developers.zomato.com
- HTML Injection @ /[restaurant]/order endpoint.
- Reflected XSS on https://www.zomato.com
- Zomato.com Reflected Cross Site Scripting
- [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2
- Reflected XSS on business-blog.zomato.com - Part I
- Stored Cross site scripting
- XSS onmouseover
- Reflected XSS in Zomato Mobile - category parameter
- Outdated MediaElement.js Reflected Cross-Site Scripting (XSS)
- Reflected XSS on business-blog.zomato.com - Part 2
- Several XSS affecting Zomato.com and developers.zomato.com
- xss found in zomato
- MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS)
- XSS in flashmediaelement.swf (business-blog.zomato.com)
- Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay
- Persistent input validation mail encoding vulnerability in the "just followed you" email notification.
- XSS on zomato.com
- XSS in "explore-keywords-dropdown" results.
- Reflected XSS on Zomato API
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.