Bug bounty program
MG
MTN Group
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | SQL Injection | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | SQL Injection | 2025-03-06 | – | 149 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Insecure Direct Object Reference | 2024-10-05 | – | 135 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Authentication | 2025-01-08 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | No weakness recorded | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | SQL Injection | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Authentication | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Cross-site Scripting | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Cross-site Scripting | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Authentication | 2025-03-04 | – | 98 |
Subdomains214,285
| Name | Scope | First seen |
|---|---|---|
| 21days2017.mtncameroon.net | Not in the scope | 2026-11-14 |
| ability.mtncameroon.net | Not in the scope | 2026-11-14 |
| autodiscover.mtncameroon.netmail | Not in the scope | 2026-11-14 |
| av.mtncameroon.net | Not in the scope | 2026-11-14 |
| bberry.mtncameroon.net | Not in the scope | 2026-11-14 |
| mail.bberry.mtncameroon.netmail | Not in the scope | 2026-11-14 |
| bcaw2017.mtncameroon.net | Not in the scope | 2026-11-14 |
| bcm-bcaw.mtncameroon.net | Not in the scope | 2026-11-14 |
| www.bcm-bcaw.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkfleet01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkfleet02.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkfleet03.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkhotda01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkhotda02.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkkibana01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkmaster01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkmaster02.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkmaster03.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkwarmda01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkwarmda02.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-elkwarmda03.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-satcap01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-satsrv01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| yde1-satcap01.btsso.mtncameroon.net | Not in the scope | 2026-11-14 |
| care.mtncameroon.net | Not in the scope | 2026-11-14 |
| care-tools.mtncameroon.net | Not in the scope | 2026-11-14 |
| www.care.mtncameroon.net | Not in the scope | 2026-11-14 |
| career-portal-test.mtncameroon.nettest | Not in the scope | 2026-11-14 |
| www.career-portal-test.mtncameroon.nettest | Not in the scope | 2026-11-14 |
| careers.mtncameroon.net | Not in the scope | 2026-11-14 |
| www.careers.mtncameroon.net | Not in the scope | 2026-11-14 |
| centrex.mtncameroon.net | Not in the scope | 2026-11-14 |
| cis.mtncameroon.net | Not in the scope | 2026-11-14 |
| clc2017.mtncameroon.net | Not in the scope | 2026-11-14 |
| clf.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-drools.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-offrering.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-offreringdrools.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-ss.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-tsat.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-tsat2.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-ttmw2.mtncameroon.net | Not in the scope | 2026-11-14 |
| clm-ttmw3.mtncameroon.net | Not in the scope | 2026-11-14 |
| cloudivr.mtncameroon.net | Not in the scope | 2026-11-14 |
| cloudstack.mtncameroon.net | Not in the scope | 2026-11-14 |
| dovip-mtncorp-1.cm.mtncameroon.net | Not in the scope | 2026-11-14 |
| mtn.cm.mtncameroon.net | Not in the scope | 2026-11-14 |
| concierge.mtncameroon.net | Not in the scope | 2026-11-14 |
| connectme.mtncameroon.net | Not in the scope | 2026-11-14 |
| www.connectme.mtncameroon.net | Not in the scope | 2026-11-14 |
| corp.mtncameroon.netinternal | Not in the scope | 2026-11-14 |
| dladc1-pbirpt00.corp.mtncameroon.netinternal | Not in the scope | 2026-11-14 |
| dmscinfr05.corp.mtncameroon.netinternal | Not in the scope | 2026-11-14 |
| coverage.mtncameroon.net | Not in the scope | 2026-11-14 |
| crius.mtncameroon.net | Not in the scope | 2026-11-14 |
| da.mtncameroon.net | Not in the scope | 2026-11-14 |
| dealers.mtncameroon.net | Not in the scope | 2026-11-14 |
| developer.mtncameroon.net | Not in the scope | 2026-11-14 |
| dialin.mtncameroon.net | Not in the scope | 2026-11-14 |
| digitalcvm.mtncameroon.net | Not in the scope | 2026-11-14 |
| divibook.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla-sp1.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla-sp2.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla1-infvc01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla1-islotttst01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-infupt01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-osmhstat01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-osmhstat02.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-satcap01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-satsrv01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-uatexternal01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-uatexternal02.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-uatprovision01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-uatprovision02.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-uatquery01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dla2-uatquery02.mtncameroon.net | Not in the scope | 2026-11-14 |
| dladc2-infupt01.mtncameroon.net | Not in the scope | 2026-11-14 |
| dladc2-soatst02.mtncameroon.net | Not in the scope | 2026-11-14 |
| dladc2-soatst03.mtncameroon.net | Not in the scope | 2026-11-14 |
| dm-ios.mtncameroon.net | Not in the scope | 2026-11-14 |
| dns.mtncameroon.net | Not in the scope | 2026-11-14 |
| dstmtntv.mtncameroon.net | Not in the scope | 2026-11-14 |
| ebilling.mtncameroon.net | Not in the scope | 2026-11-14 |
| ecare.mtncameroon.net | Not in the scope | 2026-11-14 |
| ecw.mtncameroon.net | Not in the scope | 2026-11-14 |
| ecw-test.mtncameroon.nettest | Not in the scope | 2026-11-14 |
| www.ecw-test.mtncameroon.nettest | Not in the scope | 2026-11-14 |
| www.ecw.mtncameroon.net | Not in the scope | 2026-11-14 |
| ecwpub.mtncameroon.net | Not in the scope | 2026-11-14 |
| ecwpub1.mtncameroon.net | Not in the scope | 2026-11-14 |
| esfdbss.mtncameroon.net | Not in the scope | 2026-11-14 |
| esfdbssprod.mtncameroon.net | Not in the scope | 2026-11-14 |
| esfuatvip.mtncameroon.net | Not in the scope | 2026-11-14 |
| ewpdev-prod.mtncameroon.net | Not in the scope | 2026-11-14 |
| winsbf01.ex.mtncameroon.net | Not in the scope | 2026-11-14 |
| ftp.mtncameroon.netdata | Not in the scope | 2026-11-14 |
| go.mtncameroon.net | Not in the scope | 2026-11-14 |
| helpme.mtncameroon.net | Not in the scope | 2026-11-14 |
| hlrinfo.mtncameroon.net | Not in the scope | 2026-11-14 |
| www.hlrinfo.mtncameroon.net | Not in the scope | 2026-11-14 |
28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.