Bug bounty program
MG
MTN Group
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | SQL Injection | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | SQL Injection | 2025-03-06 | – | 149 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Insecure Direct Object Reference | 2024-10-05 | – | 135 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Authentication | 2025-01-08 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | No weakness recorded | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | SQL Injection | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Authentication | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Cross-site Scripting | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Cross-site Scripting | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Authentication | 2025-03-04 | – | 98 |
Subdomains214,285
| Name | Scope | First seen |
|---|---|---|
| legacy.mtn.bjlegacy | Not in the scope | 2026-11-14 |
| lms-ga.mtn.bj | Not in the scope | 2026-11-14 |
| mail.mtn.bjmail | Not in the scope | 2026-11-14 |
| mail2.mtn.bjmail | Not in the scope | 2026-11-14 |
| mailb.mtn.bj | Not in the scope | 2026-11-14 |
| mailrequest.mtn.bj | Not in the scope | 2026-11-14 |
| mm.mtn.bj | Not in the scope | 2026-11-14 |
| www.mm.mtn.bj | Not in the scope | 2026-11-14 |
| momo-rapports.mtn.bj | Not in the scope | 2026-11-14 |
| momobusiness.mtn.bj | Not in the scope | 2026-11-14 |
| momopartenaire.mtn.bj | Not in the scope | 2026-11-14 |
| www.momopartenaire.mtn.bj | Not in the scope | 2026-11-14 |
| momorebalancer.mtn.bj | Not in the scope | 2026-11-14 |
| momorebalanceruat.mtn.bj | Not in the scope | 2026-11-14 |
| momosecours.mtn.bj | Not in the scope | 2026-11-14 |
| momoshop.mtn.bj | Not in the scope | 2026-11-14 |
| www.momoshop.mtn.bj | Not in the scope | 2026-11-14 |
| monitoring.mtn.bjmonitoring | Not in the scope | 2026-11-14 |
| mtn-onboarding.mtn.bj | Not in the scope | 2026-11-14 |
| mtn-survey.mtn.bj | Not in the scope | 2026-11-14 |
| mtncharge.mtn.bj | Not in the scope | 2026-11-14 |
| mtnhype.mtn.bj | Not in the scope | 2026-11-14 |
| mtnmomo.mtn.bj | Not in the scope | 2026-11-14 |
| www.mtnmomo.mtn.bj | Not in the scope | 2026-11-14 |
| mtnveille.mtn.bj | Not in the scope | 2026-11-14 |
| www.mtnveille.mtn.bj | Not in the scope | 2026-11-14 |
| my.mtn.bj | Not in the scope | 2026-11-14 |
| www.my.mtn.bj | Not in the scope | 2026-11-14 |
| mydataparc.mtn.bj | Not in the scope | 2026-11-14 |
| mymtn.mtn.bj | Not in the scope | 2026-11-14 |
| www.mymtn.mtn.bj | Not in the scope | 2026-11-14 |
| mymtnapp.mtn.bj | Not in the scope | 2026-11-14 |
| mymtnapp-uat.mtn.bjtest | Not in the scope | 2026-11-14 |
| myspeedtest.mtn.bj | Not in the scope | 2026-11-14 |
| test.myspeedtest.mtn.bjtest | Not in the scope | 2026-11-14 |
| www.myspeedtest.mtn.bj | Not in the scope | 2026-11-14 |
| myspeedtest01.mtn.bj | Not in the scope | 2026-11-14 |
| myspeedtest02.mtn.bj | Not in the scope | 2026-11-14 |
| nacvpn.mtn.bj | Not in the scope | 2026-11-14 |
| netportal.mtn.bj | Not in the scope | 2026-11-14 |
| ns1.mtn.bj | Not in the scope | 2026-11-14 |
| ns2.mtn.bj | Not in the scope | 2026-11-14 |
| obcc.mtn.bj | Not in the scope | 2026-11-14 |
| www.obcc.mtn.bj | Not in the scope | 2026-11-14 |
| opms.mtn.bj | Not in the scope | 2026-11-14 |
| otd.mtn.bj | Not in the scope | 2026-11-14 |
| www.otd.mtn.bj | Not in the scope | 2026-11-14 |
| owc.mtn.bj | Not in the scope | 2026-11-14 |
| patcher.mtn.bj | Not in the scope | 2026-11-14 |
| pbi.mtn.bj | Not in the scope | 2026-11-14 |
| portal.mtn.bj | Not in the scope | 2026-11-14 |
| qms.mtn.bj | Not in the scope | 2026-11-14 |
| www.qms.mtn.bj | Not in the scope | 2026-11-14 |
| radio.mtn.bj | Not in the scope | 2026-11-14 |
| rct.mtn.bj | Not in the scope | 2026-11-14 |
| rdvagence.mtn.bj | Not in the scope | 2026-11-14 |
| redirection.mtn.bj | Not in the scope | 2026-11-14 |
| survey.redirection.mtn.bj | Not in the scope | 2026-11-14 |
| registrer.mtn.bj | Not in the scope | 2026-11-14 |
| requisition.mtn.bj | Not in the scope | 2026-11-14 |
| rpm.mtn.bj | Not in the scope | 2026-11-14 |
| police.rpm.mtn.bj | Not in the scope | 2026-11-14 |
| scc.mtn.bj | Not in the scope | 2026-11-14 |
| selfcare.mtn.bj | Not in the scope | 2026-11-14 |
| servicestore.mtn.bj | Not in the scope | 2026-11-14 |
| shop.mtn.bj | Not in the scope | 2026-11-14 |
| smtp2.mtn.bjmail | Not in the scope | 2026-11-14 |
| srv-dns01.mtn.bj | Not in the scope | 2026-11-14 |
| srv-dns02.mtn.bj | Not in the scope | 2026-11-14 |
| srv-ga-dnspub01.mtn.bj | Not in the scope | 2026-11-14 |
| srv-ga-dnspub02.mtn.bj | Not in the scope | 2026-11-14 |
| srv-smtp01.mtn.bjmail | Not in the scope | 2026-11-14 |
| srv-smtp02.mtn.bjmail | Not in the scope | 2026-11-14 |
| srv-st-dnspub01.mtn.bj | Not in the scope | 2026-11-14 |
| srv-vtmg01.mtn.bj | Not in the scope | 2026-11-14 |
| srv-vtmg02.mtn.bj | Not in the scope | 2026-11-14 |
| sspc.mtn.bj | Not in the scope | 2026-11-14 |
| st-gidns01.mtn.bj | Not in the scope | 2026-11-14 |
| st-gidns02.mtn.bj | Not in the scope | 2026-11-14 |
| st-vpngw01.mtn.bj | Not in the scope | 2026-11-14 |
| st_pdns01.mtn.bj | Not in the scope | 2026-11-14 |
| st_pdns01_traffic.mtn.bj | Not in the scope | 2026-11-14 |
| st_pdns02_traffic.mtn.bj | Not in the scope | 2026-11-14 |
| standardpro.mtn.bj | Not in the scope | 2026-11-14 |
| www.standardpro.mtn.bj | Not in the scope | 2026-11-14 |
| api.strategic-session.mtn.bjapi | Not in the scope | 2026-11-14 |
| survey.mtn.bj | Not in the scope | 2026-11-14 |
| survey-redirection.mtn.bj | Not in the scope | 2026-11-14 |
| tas.mtn.bj | Not in the scope | 2026-11-14 |
| test.mtn.bjtest | Not in the scope | 2026-11-14 |
| tontine.mtn.bj | Not in the scope | 2026-11-14 |
| www.tontine.mtn.bj | Not in the scope | 2026-11-14 |
| tvcom.mtn.bj | Not in the scope | 2026-11-14 |
| ucc.mtn.bj | Not in the scope | 2026-11-14 |
| web.mtn.bj | Not in the scope | 2026-11-14 |
| webregistration.mtn.bj | Not in the scope | 2026-11-14 |
| webregistrationuat.mtn.bj | Not in the scope | 2026-11-14 |
| www.mtn.bj | Not in the scope | 2026-11-14 |
| xtratime.mtn.bj | Not in the scope | 2026-11-14 |
| yellochat.mtn.bj | Not in the scope | 2026-11-14 |
28 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.