Public Zomato bug reports.

Team Bounty Title
Zomato $500 Restaurant payment information leakage
Zomato $100 Length extension attack leading to HTML injection
Zomato $50 Posting to Twitter CSRF on php/post_twitter_authenticate.php
Zomato $250 Bypass OTP verification when placing Order
Zomato $500 [█████████] Hardcoded credentials in Android App
Zomato $300 SQL Injection, exploitable in boolean mode
Zomato $1,000 Login to any account with the emailaddress
Zomato - xss found in zomato
Zomato - CSRF To Like/Unlike Photos
Zomato - Reflected XSS in Zomato Mobile - category parameter
Zomato - Amazon S3 bucket misconfiguration (share)
Zomato - Unauthorised Access to Anyone's User Account
Zomato - test.zba.se is vulnerable to SSL POODLE
Zomato - MailPoet Newsletters <= 2.7.2 - Authenticated Reflected Cross-Site Scripting (XSS)
Zomato - XSS in flashmediaelement.swf (business-blog.zomato.com)
Zomato - takeover a lot of accounts
Zomato - CORS Misconfiguration on www.zomato.com
Zomato - [CRITICAL] Complete source code disclosure via exposed Jenkins Dashboard
Zomato - Visibility Robots.txt file
Zomato - Clickjacking login page of http://book.zomato.com/
Zomato - CSS
Zomato - Stored Cross site scripting
Zomato - XSS on zomato.com
Zomato - Unvalidated redirect on user profile website
Zomato - Bypass OTP verification when placing Order
Zomato - XSS onmouseover
Zomato - Instagram OAuth2 Implementation Leaks Access Token; Allows for Cross-Site Script Inclusion (XSSI)
Zomato - Reflected Cross-Site Scripting in www.zomato.com/php/instagram_tag_relay
Zomato - Reflected XSS on business-blog.zomato.com - Part 2
Zomato - Reflected XSS on business-blog.zomato.com - Part I
Zomato - Reflected XSS on Zomato API
Zomato - Authentication Bypassing and Sensitive Information Disclosure on Verify Email Address in Registration Flow
Zomato - Persistent XSS on Reservation / Booking Page
Zomato - NexTable: Credentials exposure
Zomato - Two XSS vulns in widget parameters (all_collections.php and o2.php)
Zomato - XSS via modified Zomato widget (res_search_widget.php)
Zomato - XSS and CSRF in Zomato Contact form
Zomato - Weak Password Policy
Zomato - Persistent input validation mail encoding vulnerability in the "just followed you" email notification.
Zomato - Several XSS affecting Zomato.com and developers.zomato.com
Zomato - Remote File Upload Vulnerability in business-blog.zomato.com
Zomato - Cross Site Scripting - type Patameter
Zomato - Twitter Disconnect CSRF
Zomato - Subdomain Takeover
Zomato - CSRF AT INVITING PEOPLE THOUGH PHONE NUMBER
Zomato - CSRF AT SELECTING ZAMATO HANDLE