XSS via modified Zomato widget (res_search_widget.php) #115402 Valid Cross-site Scripting – 2016-03-11 – – Remote File Upload Vulnerability in business-blog.zomato.com #114389 Valid Command and Code Injection – 2016-03-06 – 1 XSS and CSRF in Zomato Contact form #115248 Valid Cross-site Scripting – 2016-05-24 – 1 Two XSS vulns in widget parameters (all_collections.php and o2.php) #115560 Valid Cross-site Scripting – 2016-08-02 – 1 Persistent XSS on Reservation / Booking Page #123005 Valid Cross-site Scripting – 2016-05-27 – 1 Cross Site Scripting - type Patameter #114151 Valid Cross-site Scripting – 2016-03-06 – 2 Reflected XSS on Zomato API #125762 Valid Cross-site Scripting – 2016-05-27 – 2 XSS in "explore-keywords-dropdown" results. #347567 Valid Cross-site Scripting None 2018-05-09 – 2 NexTable: Credentials exposure #120941 Valid Cryptography High 2017-06-30 – 3 XSS on zomato.com #143294 Valid Cross-site Scripting – 2016-08-14 – 3 Subdomain Takeover #113869 Valid Information Disclosure – 2016-03-09 – 4 Persistent input validation mail encoding vulnerability in the "just followed you" email notification. #114879 Valid Cross-site Scripting – 2016-04-07 – 4 Weak Password Policy #115036 Valid Authentication – 2016-03-13 – 4 Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow #124151 Valid Authentication – 2016-05-28 – 4 Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay #138262 Valid Cross-site Scripting – 2016-06-16 – 4 XSS in flashmediaelement.swf (business-blog.zomato.com) #200351 Valid Cross-site Scripting Medium 2017-06-17 – 4 MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS) #200355 Valid Cross-site Scripting High 2017-06-17 – 4 xss found in zomato #240989 Valid Cross-site Scripting Medium 2017-06-30 – 4 CSRF AT SELECTING ZAMATO HANDLE #113857 Valid Cross-Site Request Forgery – 2016-03-18 – 5 CSRF AT INVITING PEOPLE THOUGH PHONE NUMBER #113865 Valid Misconfiguration and Insecure Design – 2016-09-14 – 5 Several XSS affecting Zomato.com and developers.zomato.com #114631 Valid Cross-site Scripting – 2016-08-02 – 5 Reflected XSS on business-blog.zomato.com - Part 2 #137906 Valid Cross-site Scripting – 2017-06-18 – 5 CSRF To Like/Unlike Photos #230837 Valid Cross-Site Request Forgery Medium 2017-06-30 – 5 Outdated MediaElement.js Reflected Cross-Site Scripting (XSS) #155228 Valid Cross-site Scripting – 2018-04-02 – 6 [www.zomato.com] Getting a complimentary dessert [Zomato Treats] on ordering a Meal at no cost #321938 Valid No weakness recorded Medium 2018-04-25 – 6 Reflected XSS in Zomato Mobile - category parameter #230119 Valid Cross-site Scripting Medium 2017-06-26 – 7 CSRF in the "Add restaurant picture" function #169699 Valid Cross-Site Request Forgery – 2017-09-14 $50 8 [api.zomato.com] Abusing LocalParams (city_id) to Inject SOLR query #953203 Valid Injection and Smuggling Low 2020-08-11 $150 8 Twitter Disconnect CSRF #114127 Valid Cross-Site Request Forgery – 2016-09-30 – 9 XSS onmouseover #139981 Valid Cross-site Scripting – 2016-08-02 – 9 Reflected XSS on business-blog.zomato.com - Part I #137905 Valid Cross-site Scripting – 2017-06-18 – 10 IDOR in treat subscriptions #313050 Valid Insecure Direct Object Reference Medium 2018-04-25 – 11 [Zomato's Blog] POST based XSS on https://www.zomato.com/blog/wp-admin/admin-ajax.php?td_theme_name=Newspaper&v=8.2 #335481 Valid Cross-site Scripting Low 2018-04-26 $100 11 [www.zomato.com] Abusing LocalParams (city) to Inject SOLR query #844428 Valid SQL Injection Low 2020-08-10 $100 11 Potential server misconfiguration leads to disclosure of vendor/ directory #271391 Valid Access Control Medium 2017-10-23 – 12 Bypass OTP verification when placing Order #247158 Valid Access Control High 2017-08-09 – 13 Unauthorized update of merchants' information via /php/merchant_details.php #255651 Valid Access Control High 2017-09-19 – 13 Zomato.com Reflected Cross Site Scripting #303522 Valid Cross-site Scripting Low 2018-04-08 $100 13 Bypass OTP verification when placing Order #142221 Valid Authentication – 2016-06-01 – 14 Reflected XSS on https://www.zomato.com #311639 Valid Cross-site Scripting Medium 2018-04-07 – 14 takeover a lot of accounts #180388 Valid No weakness recorded High 2017-03-08 – 15 test.zba.se is vulnerable to SSL POODLE #201520 Valid Cryptography Medium 2017-02-27 – 15 Posting to Twitter CSRF on php/post_twitter_authenticate.php #249234 Valid Cross-Site Request Forgery Low 2017-08-19 $50 15 Restaurant payment information leakage #252043 Valid No weakness recorded Critical 2017-08-24 – 15 User Profiles Leak PII in HTML Document for Mobile Browser User Agents #288596 Valid Information Disclosure Medium 2017-12-28 $500 15 Phishing user to download malicious app could lead to leakage of User Access Token, Email, Name and Profile photo via exported RemoteService #384257 Valid Information Disclosure Low 2018-09-11 $300 15 HTML Injection @ /[restaurant]/order endpoint. #738810 Valid Cross-site Scripting Low 2021-09-07 $150 15 [www.zomato.com] IDOR - Delete/Deactivate ANY/ALL Promos through a Post Request at **clients/promoDataHandler.php** #264754 Valid Insecure Direct Object Reference – 2017-12-28 – 17 Amazon S3 bucket misconfiguration (share) #229690 Valid Access Control – 2017-05-18 – 18 [www.zomato.com] Privilege Escalation - Control reviews - /████dashboard_handler.php #300099 Valid Access Control – 2018-03-29 $300 18