[www.zomato.com] Availing Zomato Gold membership for free by tampering plan id(s) Analysed #511044 Valid Input Validation and Logic Medium 2019-03-18 – 229 [www.zomato.com] Blind XSS on one of the Admin Dashboard Analysed #724889 Valid Cross-site Scripting High 2019-11-19 $750 221 Add upto 10K rupees to a wallet by paying an arbitrary amount Analysed #1408782 Valid Input Validation and Logic High 2022-02-23 $2,000 132 Able to manipulate order amount by removing cancellation amount and cause financial impact Analysed #614523 Valid Input Validation and Logic High 2019-08-16 – 130 Availing Zomato gold by using a random third-party `wallet_id` Analysed #938021 Valid Input Validation and Logic Critical 2020-08-07 $2,000 116 [Zomato Order] Insecure deeplink leads to sensitive information disclosure Analysed #532225 Valid No weakness recorded High 2021-09-23 $750 114 Claiming the listing of a non-delivery restaurant through OTP manipulation Analysed #1330529 Valid Access Control Critical 2022-02-22 $3,250 108 [www.zomato.com] Blind XSS in one of the admin dashboard Analysed #461272 Valid Cross-site Scripting High 2019-05-01 $500 102 [www.zomato.com] Tampering with Order Quantity and paying less amount then actual amount, leads to business loss Analysed #403783 Valid Input Validation and Logic High 2018-09-17 – 78 IDOR to delete images from other stores Analysed #404797 Valid Insecure Direct Object Reference Low 2018-09-05 $600 67 [www.zomato.com] Blind XSS in one of the Admin Dashboard Analysed #419731 Valid Cross-site Scripting – 2018-12-03 – 61 Blind XSS - Report review - Admin panel Analysed #314126 Valid Cross-site Scripting Medium 2018-03-29 $350 41 [www.zomato.com/dubai/gold] CRITICAL - Allowing arbitrary amount to become a GOLD Member Analysed #254211 Valid Access Control Medium 2017-10-27 – 34 Self-Stored XSS - Chained with login/logout CSRF Analysed #632017 Valid Cross-site Scripting Medium 2019-07-03 $300 31