Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Missing captcha and rate limit protection in help form#1165223 | Valid | Input Validation and Logic | Medium | 2021-12-11 | – | 3 |
| Upload directory of Mtn.co.sz has listing enabled#760484 | Valid | Information Disclosure | Medium | 2020-02-05 | – | 4 |
| CVE-2021-38314 @ https://www.mtn.ci#1351338 | Valid | No weakness recorded | Medium | 2022-09-05 | – | 4 |
| blind sql on [selfcare.mtn.com.af]#925007 | Valid | SQL Injection | Medium | 2021-09-09 | – | 5 |
| [play.mtn.co.za] Application level DoS via xmlrpc.php#925519 | Valid | Input Validation and Logic | Medium | 2021-09-10 | – | 6 |
| XSS at videostore.mtnonline.com/GL/*.aspx via all parameters#1244731 | Valid | Cross-site Scripting | Medium | 2022-05-01 | – | 6 |
| Upload directory of Mtn.ci#762118 | Valid | Information Disclosure | Medium | 2020-02-05 | – | 7 |
| firebase credentials leaks @ ███████#1351326 | Valid | Information Disclosure | Medium | 2022-09-05 | – | 7 |
| Information Disclosure Microsoft IIS Server service.cnf in a mtn website#767066 | Valid | Information Disclosure | Medium | 2020-04-03 | – | 8 |
| Exposed .bash_history at http://21days2017.mtncameroon.net/.bash_history#801437 | Valid | Information Disclosure | Medium | 2022-03-20 | – | 8 |
| Information disclosure through django debug mode#1434276 | Valid | Information Disclosure | Medium | 2022-09-05 | – | 8 |
| XSS at http://nextapps.mtnonline.com/search/suggest/q/{xss payload}#1244722 | Valid | Cross-site Scripting | Medium | 2022-05-01 | – | 9 |
| Reflected XSS in chatbot#1735622 | Valid | Cross-site Scripting | Medium | 2022-11-19 | – | 10 |
| Cross-site Scripting (XSS) - Reflected on http://h1b4e.n2.ips.mtn.co.ug:8080 via Nginx-module#1159362 | Valid | Cross-site Scripting | Medium | 2024-08-24 | – | 12 |
| firebase credentials leaks @ https://mpulse.mtnonline.com#1351329 | Valid | Information Disclosure | Medium | 2022-09-05 | – | 12 |
| Information Disclosure FrontPage Configuration Information /_vti_inf.html in https://www.mtn.co.za/#761617 | Valid | Access Control | Medium | 2020-04-03 | – | 13 |
| Password reset token leak on third party website via Referer header [██████████]#1320242 | Valid | No weakness recorded | Medium | 2022-09-01 | – | 13 |
| No rate limit in otp code sendingAnalysed#1060518 | Valid | Misconfiguration and Insecure Design | Medium | 2021-08-16 | – | 14 |
| Accessible Restricted directory on [bcm-bcaw.mtn.cm]Analysed#789388 | Valid | Information Disclosure | Medium | 2020-07-15 | – | 15 |
| Reflected XSS on gamesclub.mtn.com.gAnalysed#1069528 | Valid | Cross-site Scripting | Medium | 2021-05-24 | – | 15 |
| Reflected XSS at dailydeals.mtn.co.zaAnalysed#1210921 | Valid | Cross-site Scripting | Medium | 2021-12-24 | – | 15 |
| xss on [developers.mtn.com]Analysed#924851 | Valid | Cross-site Scripting | Medium | 2022-04-19 | – | 16 |
| HTML injection in email content during registration via FirstName/LastName parameterAnalysed#1256496 | Valid | Cross-site Scripting | Medium | 2021-12-18 | – | 16 |
| Unsafe cors sharing of admin usersAnalysed#772744 | Valid | No weakness recorded | Medium | 2020-04-30 | – | 17 |
| Reflected XSS on play.mtn.co.zaAnalysed#1061199 | Valid | Cross-site Scripting | Medium | 2021-08-14 | – | 17 |
| Cross-site Scripting (XSS) - Reflected on http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via `callback` parameterAnalysed#1147176 | Valid | Cross-site Scripting | Medium | 2024-08-24 | – | 17 |
| OTP bypass - Unintended disclosure of OTP to client allows attacker to manage users' subscriptionsAnalysed#777957 | Valid | Access Control | Medium | 2020-04-11 | – | 19 |
| Reflected XSS on dailydeals.mtn.co.zaAnalysed#1212235 | Valid | Cross-site Scripting | Medium | 2021-12-24 | – | 19 |
| Email verification bypassed during sing up (████████)Analysed#1182016 | Valid | Misconfiguration and Insecure Design | Medium | 2021-08-19 | – | 20 |
| Reflected XSS on mtnhottseat.mtn.com.ghAnalysed#1069527 | Valid | Cross-site Scripting | Medium | 2021-05-24 | – | 22 |
| RXSS - http://macademy.mtnonline.comAnalysed#1091165 | Valid | Cross-site Scripting | Medium | 2021-12-11 | – | 23 |
| Cross-Site Request Forgery (CSRF) to xssAnalysed#1183241 | Valid | Cross-Site Request Forgery | Medium | 2022-10-30 | – | 25 |
| Reflected Cross Site Scripting Cisco ASA on myvpn.mtncameroon.net CVE-2020-3580Analysed#1247833 | Valid | Cross-site Scripting | Medium | 2024-08-23 | – | 28 |
| Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453Analysed#1158823 | Valid | Cross-site Scripting | Medium | 2024-08-24 | – | 30 |
| SharePoint exposed web services in a subdomainAnalysed#761158 | Valid | Access Control | Medium | 2020-05-16 | – | 31 |
| Unauthenticated phpinfo()files could lead to ability file read at h2f54.n1.ips.mtn.co.ug [/dashboard/]Analysed#2610478 | Valid | Misconfiguration and Insecure Design | Medium | 2025-02-20 | – | 33 |
| Cross-site Scripting (XSS) - ReflectedAnalysed#1183336 | Valid | Cross-site Scripting | Medium | 2022-10-30 | – | 34 |
| Unauthenticated phpinfo()files could lead to ability file read at █████████Analysed#2764952 | Valid | Access Control | Medium | 2024-11-15 | – | 44 |
| No rate limit in OTP code sendingAnalysed#1780399 | Valid | No weakness recorded | Medium | 2024-10-21 | – | 49 |
| Information disclosure via enabled Django Debug ModeAnalysed#2201370 | Valid | Information Disclosure | Medium | 2024-12-25 | – | 55 |
| SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciAnalysed#1379080 | Valid | Server-Side Request Forgery | Medium | 2024-09-26 | – | 60 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | Information Disclosure | Medium | 2025-02-23 | – | 61 |
| PHP info page disclosure in ██████████Analysed#1848780 | Valid | No weakness recorded | Medium | 2024-08-30 | – | 62 |
| Insecure direct Object Reference(Horizontal Escalation)Analysed#2322663 | Valid | Insecure Direct Object Reference | Medium | 2025-01-31 | – | 66 |
| Broken Access Control(Horizontal Privilege Escalation).Analysed#2319586 | Valid | Access Control | Medium | 2025-01-31 | – | 69 |
| cross site scripting reflectedAnalysed#1496897 | Valid | Cross-site Scripting | Medium | 2024-09-09 | – | 81 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Valid | Cross-site Scripting | Medium | 2024-08-30 | – | 100 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.