RCE on build server via misconfigured pip install Analysed #946409 Valid Supply Chain and Malicious Code Critical 2021-02-09 – 366 yelp.com XSS ATO (via login keylogger, link Google account) Analysed #2010530 Valid Cross-site Scripting High 2023-08-15 – 324 I.D.O.R To Order,Book,Buy,reserve On YELP FOR FREE (UNAUTHORIZED USE OF OTHER USER'S CREDIT CARD) Analysed #391092 Valid Insecure Direct Object Reference Critical 2020-08-19 – 214 Object Level access control leads to reading user's full requests, sessions, and error messages Analysed #2891449 Valid Access Control Medium 2025-01-18 – 113 CRITICAL Insecure Direct Object Reference (I.D.O.R) - Link Other User's Credit Card Analysed #358143 Valid Information Disclosure High 2020-08-19 – 87 Access to internal CMS containing private Data Analysed #100926 Valid Authentication – 2016-10-07 – 83 Yelp for Business: locked Email field silently editable via API Analysed #3766455 Valid Input Validation and Logic Medium 2026-07-02 – 76 Privilege Escalation - A Non Owner User Who Does not Have access to the user management can invite other users to the restaurant page Analysed #2396549 Valid Access Control Low 2025-01-29 – 75 X-Forward-For Header allows to bypass access restrictions Analysed #1011767 Valid Access Control Medium 2020-10-26 – 73 Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account Analysed #2396571 Valid Access Control Low 2025-01-28 – 60 RXSS AT https://proze.yelp.com/tmsubscribe.net/vidsn.aspx Analysed #2947762 Valid Cross-site Scripting Medium 2025-06-30 – 56 Debug Deep Link Abuse Allows Repeated Forced Logout and Application Disruption Analysed #3829030 Valid Misconfiguration and Insecure Design Low 2026-08-13 – 54 Bybass The Closing of the account and logged again to your account Analysed #167489 Valid Authentication – 2016-10-21 – 34 I.D.O.R TO EDIT ALL USER'S CREDIT CARD INFORMATION+(Partial credit card info disclosure) Analysed #361984 Valid Insecure Direct Object Reference Medium 2020-08-19 – 32 No rate limiting for confirmation email lead to email flooding Analysed #774050 Valid Misconfiguration and Insecure Design Medium 2020-02-11 – 24 Able to download arbitrary PHP files at yelpblog.com Analysed #194351 Valid Access Control None 2017-02-06 – 21 Information disclosure - emails disclosed in response > staging.seatme.us Analysed #49170 Valid Cross-Site Request Forgery – 2017-05-11 – 21 CRITICAL-CLICKJACKING at Yelp Reservations Resulting in exposure of victim Private Data (Email info) + Victim Credit Card MissUse. Analysed #355859 Valid Access Control Medium 2020-08-21 – 18 Password reset token not expiring Analysed #170161 Valid Authentication – 2017-11-09 – 18 Direct access to tox.ini file which is contain configuration details #1824865 Valid Information Disclosure Low 2023-03-02 – 15 Clickjacking Vulnerability found on Yelp #214087 Valid Cross-Site Request Forgery Low 2017-05-12 – 13 CSRF on signup endpoint (auto-api.yelp.com) #178831 Valid Cross-Site Request Forgery – 2017-03-01 – 13 Leaking sensitive information lead to compromise employer API keys #273630 Valid Information Disclosure High 2017-11-09 – 12 IDNs displayed in unicode in messages/about/talk sections (Homograph Attack) #172933 Valid Misconfiguration and Insecure Design – 2017-11-09 – 12 Verification of email addresses possible through https://www.yelp.com/signup/facebook #194721 Valid Information Disclosure – 2017-09-16 – 10 Verification of E-Mail address possible on https://biz.yelp.com/login and https://biz.yelp.com/forgot #166265 Valid Information Disclosure – 2016-10-27 – 10 Clickjacking lead to remove review #965141 Valid No weakness recorded Medium 2020-09-01 – 7 Unauthorized Use of Victim Credit Card #391385 Valid Information Disclosure Low 2020-08-21 – 7 Firefly's verify_access_token() function does a byte-by-byte comparison of HMAC values. #240958 Valid Cryptography None 2017-07-10 – 7 X.509 certificate validation fails on international vanity domains #180538 Valid Misconfiguration and Insecure Design None 2017-02-06 – 7 Requesting Show CheckIn Alert for Non Friend User #174882 Valid Information Disclosure Low 2016-10-27 – 7 ClickJacking on IMPORTANT Functions of Yelp #305128 Valid Misconfiguration and Insecure Design Low 2020-08-21 – 5