Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Upload directory of Mtn.co.sz has listing enabled#760484 | Valid | Information Disclosure | Medium | 2020-02-05 | – | 4 |
| Exposed gitlab repo at https://adammanco.mtn.com/api/v4/projects#1351359 | Valid | Information Disclosure | Low | 2022-09-05 | – | 5 |
| Wordpress users disclosure from json and xml file#1408589 | Valid | Information Disclosure | Low | 2022-09-02 | – | 6 |
| Upload directory of Mtn.ci#762118 | Valid | Information Disclosure | Medium | 2020-02-05 | – | 7 |
| Insecure crossdomain.xml on https://vdc.mtnonline.com/#838817 | Valid | Information Disclosure | High | 2022-03-20 | – | 7 |
| firebase credentials leaks @ ███████#1351326 | Valid | Information Disclosure | Medium | 2022-09-05 | – | 7 |
| Information Disclosure Microsoft IIS Server service.cnf in a mtn website#767066 | Valid | Information Disclosure | Medium | 2020-04-03 | – | 8 |
| Exposed .bash_history at http://21days2017.mtncameroon.net/.bash_history#801437 | Valid | Information Disclosure | Medium | 2022-03-20 | – | 8 |
| Information disclosure through django debug mode#1434276 | Valid | Information Disclosure | Medium | 2022-09-05 | – | 8 |
| firebase credentials leaks @ https://mpulse.mtnonline.com#1351329 | Valid | Information Disclosure | Medium | 2022-09-05 | – | 12 |
| Insecure Storage of Sensitive Information on lonestarcell.com serverAnalysed#1482830 | Valid | Information Disclosure | Critical | 2022-04-09 | – | 14 |
| Accessible Restricted directory on [bcm-bcaw.mtn.cm]Analysed#789388 | Valid | Information Disclosure | Medium | 2020-07-15 | – | 15 |
| Firebase Database Takeover in https://pulseradio.mtn.co.ug/Analysed#1447751 | Valid | Information Disclosure | Critical | 2022-12-01 | – | 15 |
| PHP Info Exposing Secrets at https://radio.mtn.bj/infoAnalysed#1049402 | Valid | Information Disclosure | High | 2022-03-08 | – | 18 |
| Information Disclosure Leads To User Data LeakAnalysed#1541660 | Valid | Information Disclosure | – | 2022-12-24 | – | 25 |
| Wordpress users Disclosure [ /wp-json/wp/v2/users/ ] Not Resolved ()Analysed#1784999 | Valid | Information Disclosure | Critical | 2022-12-28 | – | 29 |
| Leaking usernames through endpoints WordpressAnalysed#1785021 | Valid | Information Disclosure | High | 2024-08-10 | – | 31 |
| information discloure via logs files at ==> https://ihelp.mtnbusiness.com/logfiles/Log_21-06-2021.txtAnalysed#1239633 | Valid | Information Disclosure | High | 2021-08-20 | – | 33 |
| Wordpress users Disclosure [ /wp-json/wp/v2/users/ ]Analysed#1735586 | Valid | Information Disclosure | Critical | 2022-11-27 | – | 33 |
| CVE-2010-1429 JBoss Insecure Storage of Sensitive Information on ips.mtn.co.ugAnalysed#2375659 | Valid | Information Disclosure | High | 2024-08-30 | – | 42 |
| Exposure Of Admin Username & PasswordAnalysed#1703733 | Valid | Information Disclosure | Critical | 2022-12-25 | – | 48 |
| Information disclosure via enabled Django Debug ModeAnalysed#2201370 | Valid | Information Disclosure | Medium | 2024-12-25 | – | 55 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | Information Disclosure | Medium | 2025-02-23 | – | 61 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.