XSS via modified Zomato widget (res_search_widget.php) #115402 Valid Cross-site Scripting – 2016-03-11 – – Remote File Upload Vulnerability in business-blog.zomato.com #114389 Valid Command and Code Injection – 2016-03-06 – 1 XSS and CSRF in Zomato Contact form #115248 Valid Cross-site Scripting – 2016-05-24 – 1 Two XSS vulns in widget parameters (all_collections.php and o2.php) #115560 Valid Cross-site Scripting – 2016-08-02 – 1 Persistent XSS on Reservation / Booking Page #123005 Valid Cross-site Scripting – 2016-05-27 – 1 Unvalidated redirect on user profile website #143265 Informative Open Redirect – 2017-05-18 – 1 Cross Site Scripting - type Patameter #114151 Valid Cross-site Scripting – 2016-03-06 – 2 Reflected XSS on Zomato API #125762 Valid Cross-site Scripting – 2016-05-27 – 2 CSS #145686 Informative No weakness recorded – 2017-05-18 – 2 URL is vulnerable to clickjacking #337219 Informative Misconfiguration and Insecure Design – 2018-04-14 – 2 XSS in "explore-keywords-dropdown" results. #347567 Valid Cross-site Scripting – 2018-05-09 – 2 Lack of Password Confirmation for Account Deletion #950471 N/A Misconfiguration and Insecure Design – 2020-08-11 – 2 NexTable: Credentials exposure #120941 Valid Cryptography – 2017-06-30 – 3 XSS on zomato.com #143294 Valid Cross-site Scripting – 2016-08-14 – 3 Clickjacking: Delete Account, Change privacy settings, Rate business, follow/unfollow (IE) #338569 Duplicate Misconfiguration and Insecure Design – 2018-04-15 – 3 Subdomain Takeover #113869 Valid Information Disclosure – 2016-03-09 – 4 Persistent input validation mail encoding vulnerability in the "just followed you" email notification. #114879 Valid Cross-site Scripting – 2016-04-07 – 4 Weak Password Policy #115036 Valid Authentication – 2016-03-13 – 4 Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow #124151 Valid Authentication – 2016-05-28 – 4 Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay #138262 Valid Cross-site Scripting – 2016-06-16 – 4 Clickjacking login page of http://book.zomato.com/ #146948 Informative Misconfiguration and Insecure Design – 2017-05-18 – 4 XSS in flashmediaelement.swf (business-blog.zomato.com) #200351 Valid Cross-site Scripting – 2017-06-17 – 4 MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS) #200355 Valid Cross-site Scripting – 2017-06-17 – 4 xss found in zomato #240989 Valid Cross-site Scripting – 2017-06-30 – 4 CSRF AT SELECTING ZAMATO HANDLE #113857 Valid Cross-Site Request Forgery – 2016-03-18 – 5 CSRF AT INVITING PEOPLE THOUGH PHONE NUMBER #113865 Valid Misconfiguration and Insecure Design – 2016-09-14 – 5 Several XSS affecting Zomato.com and developers.zomato.com #114631 Valid Cross-site Scripting – 2016-08-02 – 5 Reflected XSS on business-blog.zomato.com - Part 2 #137906 Valid Cross-site Scripting – 2017-06-18 – 5 CSRF To Like/Unlike Photos #230837 Valid Cross-Site Request Forgery – 2017-06-30 – 5 Outdated MediaElement.js Reflected Cross-Site Scripting (XSS) #155228 Valid Cross-site Scripting – 2018-04-02 – 6 [www.zomato.com] Getting a complimentary dessert [Zomato Treats] on ordering a Meal at no cost #321938 Valid No weakness recorded – 2018-04-25 – 6 Reflected XSS in Zomato Mobile - category parameter #230119 Valid Cross-site Scripting – 2017-06-26 – 7 Bypassing the SMS sending limit for download app link. #517711 Duplicate Authentication – 2019-04-16 – 7 CSRF in the "Add restaurant picture" function #169699 Valid Cross-Site Request Forgery – 2017-09-14 $50 8 [api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR query #953203 Valid Injection and Smuggling – 2020-08-11 $150 8 Twitter Disconnect CSRF #114127 Valid Cross-Site Request Forgery – 2016-09-30 – 9 XSS onmouseover #139981 Valid Cross-site Scripting – 2016-08-02 – 9 Stored Cross site scripting #145246 Duplicate Cross-site Scripting – 2016-06-28 – 9 Zomato Map server going out of memory while resizing map image #751904 N/A Memory Corruption – 2019-12-05 – 9 Reflected XSS on business-blog.zomato.com - Part I #137905 Valid Cross-site Scripting – 2017-06-18 – 10 Visibility Robots.txt file #156182 Informative Information Disclosure – 2017-05-18 – 10 Mathematical error found in meals for one #819333 N/A Input Validation and Logic – 2020-04-29 – 10 IDOR in treat subscriptions #313050 Valid Insecure Direct Object Reference – 2018-04-25 – 11 [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2 #335481 Valid Cross-site Scripting – 2018-04-26 $100 11 Open Redirect On Your Login Panel #473064 Informative Open Redirect – 2019-02-14 – 11 Sending Unlimited Emails to anyone from zomato mail server. #518928 Informative Authentication – 2019-04-16 – 11 [www.zomato.com] Abusing LocalParams (city) to Inject SOLR query #844428 Valid SQL Injection – 2020-08-10 $100 11 The vulnerabilities found were XSS, Public disclosure, Network enumeration via CSRF, DLL hijacking. #927413 N/A Cross-Site Request Forgery – 2020-07-21 – 11 Potential server misconfiguration leads to disclosure of vendor/ directory #271391 Valid Access Control – 2017-10-23 – 12 Bypass OTP verification when placing Order #247158 Valid Access Control – 2017-08-09 – 13