Bug bounty program
MG
MTN Group
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | SQL Injection | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | SQL Injection | 2025-03-06 | – | 149 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Insecure Direct Object Reference | 2024-10-05 | – | 135 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Authentication | 2025-01-08 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | No weakness recorded | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | SQL Injection | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Authentication | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Cross-site Scripting | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Cross-site Scripting | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Authentication | 2025-03-04 | – | 98 |
Subdomains214,285
| Name | Scope | First seen |
|---|---|---|
| acunetix.mtn.co.rw | Not in the scope | 2026-11-14 |
| admin.mtn.co.rwadmin | Not in the scope | 2026-11-14 |
| agent-management.mtn.co.rwadmin | Not in the scope | 2026-11-14 |
| analytics-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| androidappgame.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwanda.api.mtn.co.rwapi | Not in the scope | 2026-11-14 |
| apiapp.mtn.co.rw | Not in the scope | 2026-11-14 |
| apigw.mtn.co.rwapi | Not in the scope | 2026-11-14 |
| autodiscover.mtn.co.rwmail | Not in the scope | 2026-11-14 |
| automation.mtn.co.rw | Not in the scope | 2026-11-14 |
| phonebook.backup.mtn.co.rwdata | Not in the scope | 2026-11-14 |
| balances-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| bsssoadrprov.mtn.co.rw | Not in the scope | 2026-11-14 |
| bulk-sms.mtn.co.rw | Not in the scope | 2026-11-14 |
| bulksms.mtn.co.rw | Not in the scope | 2026-11-14 |
| www.bulksms.mtn.co.rw | Not in the scope | 2026-11-14 |
| bulksmsapi.mtn.co.rw | Not in the scope | 2026-11-14 |
| www.bulksmsapi.mtn.co.rw | Not in the scope | 2026-11-14 |
| bulksmsportal.mtn.co.rw | Not in the scope | 2026-11-14 |
| www.bulksmsportal.mtn.co.rw | Not in the scope | 2026-11-14 |
| bundlesonline.mtn.co.rw | Not in the scope | 2026-11-14 |
| store.business.mtn.co.rw | Not in the scope | 2026-11-14 |
| cloudivr.mtn.co.rw | Not in the scope | 2026-11-14 |
| config-management-dev-my.mtn.co.rwadmin, dev | Not in the scope | 2026-11-14 |
| consul-dev-my.mtn.co.rwdev, tools | Not in the scope | 2026-11-14 |
| domain.mtn.co.rw | Not in the scope | 2026-11-14 |
| ecare.mtn.co.rw | Not in the scope | 2026-11-14 |
| ecw.mtn.co.rw | Not in the scope | 2026-11-14 |
| ecwp.mtn.co.rw | Not in the scope | 2026-11-14 |
| ecwtest.mtn.co.rw | Not in the scope | 2026-11-14 |
| edgerelay.mtn.co.rw | Not in the scope | 2026-11-14 |
| erst.mtn.co.rw | Not in the scope | 2026-11-14 |
| f5.mtn.co.rw | Not in the scope | 2026-11-14 |
| ftp.mtn.co.rwdata | Not in the scope | 2026-11-14 |
| ftprw.mtn.co.rw | Not in the scope | 2026-11-14 |
| gamesclub.mtn.co.rw | Not in the scope | 2026-11-14 |
| help-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| hotspot.mtn.co.rw | Not in the scope | 2026-11-14 |
| imap.mtn.co.rwmail | Not in the scope | 2026-11-14 |
| logrwfraudapidev.mtn.co.rw | Not in the scope | 2026-11-14 |
| logrwfraudapiprod.mtn.co.rw | Not in the scope | 2026-11-14 |
| macyemacye.mtn.co.rw | Not in the scope | 2026-11-14 |
| madapi.mtn.co.rw | Not in the scope | 2026-11-14 |
| mail.mtn.co.rwmail | Not in the scope | 2026-11-14 |
| mcharge.mtn.co.rw | Not in the scope | 2026-11-14 |
| menya.mtn.co.rw | Not in the scope | 2026-11-14 |
| metricrwfraudapidev.mtn.co.rw | Not in the scope | 2026-11-14 |
| metricrwfraudapiprod.mtn.co.rw | Not in the scope | 2026-11-14 |
| mgi-prod.mtn.co.rw | Not in the scope | 2026-11-14 |
| mgi-uat.mtn.co.rwtest | Not in the scope | 2026-11-14 |
| mgiuat.mtn.co.rw | Not in the scope | 2026-11-14 |
| miniodev-rem.mtn.co.rw | Not in the scope | 2026-11-14 |
| mnp-test.mtn.co.rwtest | Not in the scope | 2026-11-14 |
| mobappvtu.mtn.co.rw | Not in the scope | 2026-11-14 |
| mobilemoney.mtn.co.rw | Not in the scope | 2026-11-14 |
| momo-test.mtn.co.rwtest | Not in the scope | 2026-11-14 |
| momoapi.mtn.co.rw | Not in the scope | 2026-11-14 |
| proxy.momoapi.mtn.co.rw | Not in the scope | 2026-11-14 |
| momobusiness.mtn.co.rw | Not in the scope | 2026-11-14 |
| momocallback.mtn.co.rw | Not in the scope | 2026-11-14 |
| momodeveloper.mtn.co.rw | Not in the scope | 2026-11-14 |
| sandbox.momodeveloper.mtn.co.rwtest | Not in the scope | 2026-11-14 |
| momoingressdev.mtn.co.rw | Not in the scope | 2026-11-14 |
| momowebaccess.mtn.co.rw | Not in the scope | 2026-11-14 |
| mowali-sandbox.mtn.co.rwtest | Not in the scope | 2026-11-14 |
| mtn-id-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| mtncallertunez.mtn.co.rw | Not in the scope | 2026-11-14 |
| mtnid.mtn.co.rw | Not in the scope | 2026-11-14 |
| mtnmomo.mtn.co.rw | Not in the scope | 2026-11-14 |
| mtnrwnas1-ilo.mtn.co.rw | Not in the scope | 2026-11-14 |
| mtnrwnas2-ilo.mtn.co.rw | Not in the scope | 2026-11-14 |
| mtnwebappsvr.mtn.co.rw | Not in the scope | 2026-11-14 |
| mymtn.mtn.co.rw | Not in the scope | 2026-11-14 |
| myoutlook.mtn.co.rw | Not in the scope | 2026-11-14 |
| myspace.mtn.co.rw | Not in the scope | 2026-11-14 |
| neon.mtn.co.rw | Not in the scope | 2026-11-14 |
| nginx-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| nnmi-ilo.mtn.co.rw | Not in the scope | 2026-11-14 |
| notification-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| partner.mtn.co.rw | Not in the scope | 2026-11-14 |
| partnergui.mtn.co.rw | Not in the scope | 2026-11-14 |
| pop.mtn.co.rw | Not in the scope | 2026-11-14 |
| mtndeveloperapi.portal.mtn.co.rw | Not in the scope | 2026-11-14 |
| products-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| profiles-dev-my.mtn.co.rwdev | Not in the scope | 2026-11-14 |
| register-fixedlines.mtn.co.rw | Not in the scope | 2026-11-14 |
| rem-auth.mtn.co.rwauth | Not in the scope | 2026-11-14 |
| restotest.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwfraudapidev.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwfraudapiprod.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwfraudapistg.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwnykubernet01.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwnykubernet02.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwnykubnet.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwpbiee01-ilo.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwpmisftp-ilo.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwrm-nsxmgr.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwrm-nsxmgr-01.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwrm-nsxmgr-02.mtn.co.rw | Not in the scope | 2026-11-14 |
| rwrm-nsxmgr-03.mtn.co.rw | Not in the scope | 2026-11-14 |
28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.