Missing captcha and rate limit protection in help form #1165223 Valid Input Validation and Logic Medium 2021-12-11 – 3 Upload directory of Mtn.co.sz has listing enabled #760484 Valid Information Disclosure Medium 2020-02-05 – 4 CVE-2021-38314 @ https://www.mtn.ci #1351338 Valid No weakness recorded Medium 2022-09-05 – 4 CVE-2021-38314 @ https://www.mtn.co.rw #1351341 Valid No weakness recorded – 2022-09-05 – 4 blind sql on [selfcare.mtn.com.af] #925007 Valid SQL Injection Medium 2021-09-09 – 5 Exposed gitlab repo at https://adammanco.mtn.com/api/v4/projects #1351359 Valid Information Disclosure Low 2022-09-05 – 5 Default Admin Username and Password on remedysso.mtncameroon.net #1397786 Valid No weakness recorded High 2022-09-01 – 5 [play.mtn.co.za] Application level DoS via xmlrpc.php #925519 Valid Input Validation and Logic Medium 2021-09-10 – 6 XSS at videostore.mtnonline.com/GL/*.aspx via all parameters #1244731 Valid Cross-site Scripting Medium 2022-05-01 – 6 Wordpress users disclosure from json and xml file #1408589 Valid Information Disclosure Low 2022-09-02 – 6 String length restriction byepass at https://callerfeel.mtnonline.com/profile/feedback.html #1638347 Valid Misconfiguration and Insecure Design High 2022-09-07 – 6 Upload directory of Mtn.ci #762118 Valid Information Disclosure Medium 2020-02-05 – 7 Insecure crossdomain.xml on https://vdc.mtnonline.com/ #838817 Valid Information Disclosure High 2022-03-20 – 7 firebase credentials leaks @ ███████ #1351326 Valid Information Disclosure Medium 2022-09-05 – 7 Information Disclosure Microsoft IIS Server service.cnf in a mtn website #767066 Valid Information Disclosure Medium 2020-04-03 – 8 Java Debug Console Provides Command Injection Without Privellage Esclation #767482 Valid Command and Code Injection Critical 2020-07-23 – 8 Exposed .bash_history at http://21days2017.mtncameroon.net/.bash_history #801437 Valid Information Disclosure Medium 2022-03-20 – 8 Information disclosure through django debug mode #1434276 Valid Information Disclosure Medium 2022-09-05 – 8 SQL injection [futexpert.mtngbissau.com] #924855 Valid SQL Injection High 2021-09-09 – 9 XSS at http://nextapps.mtnonline.com/search/suggest/q/{xss payload} #1244722 Valid Cross-site Scripting Medium 2022-05-01 – 9 Unauthenticated Arbitrary File Deletion (CVE-2020-3187) #1056611 Valid File and Path Handling High 2021-08-29 – 10 No password length restriction in reset password endpoint at http://suppliers.mtn.cm #1285694 Valid No weakness recorded Critical 2022-09-05 – 10 Reflected xss on videostore.mtnonline.com #1646248 Valid Cross-site Scripting High 2022-09-25 – 10 Reflected XSS in chatbot #1735622 Valid Cross-site Scripting Medium 2022-11-19 – 10 Developer Mistake #1058135 Valid No weakness recorded None 2022-12-25 – 11 Disclosure of internal information using hidden NTLM authentication leading to an exploit server #853284 Valid Access Control High 2021-08-04 – 12 CVE-2018-6389 exploitation - using scripts loader #925425 Valid Input Validation and Logic High 2021-08-18 – 12 Cross-site Scripting (XSS) - Reflected on http://h1b4e.n2.ips.mtn.co.ug:8080 via Nginx-module #1159362 Valid Cross-site Scripting Medium 2024-08-24 – 12 Remote code execution due to unvalidated file upload #1164452 Valid Input Validation and Logic Critical 2022-09-01 – 12 firebase credentials leaks @ https://mpulse.mtnonline.com #1351329 Valid Information Disclosure Medium 2022-09-05 – 12 Open redirection at https://smartreports.mtncameroon.net #1530396 Valid Open Redirect Low 2022-07-30 – 12 Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP code #761000 Valid Authentication High 2020-04-13 – 13 Information Disclosure FrontPage Configuration Information /_vti_inf.html in https://www.mtn.co.za/ #761617 Valid Access Control Medium 2020-04-03 – 13 No rate limit lead to otp brute forcing #1060541 Valid Authentication High 2021-08-16 – 13 Password reset token leak on third party website via Referer header [██████████] #1320242 Valid No weakness recorded Medium 2022-09-01 – 13 Sensitive Information Disclosure Through Config File #1397788 Valid Cryptography High 2022-09-01 – 13 Unprotected Direct Object Reference #1536936 Valid Insecure Direct Object Reference Critical 2022-12-01 – 13 No rate limit in otp code sending #1060518 Valid Misconfiguration and Insecure Design Medium 2021-08-16 – 14 cross site scripting in : mtn.bj #1264834 Valid Cross-site Scripting High 2022-08-06 – 14 Insecure Storage of Sensitive Information on lonestarcell.com server #1482830 Valid Information Disclosure Critical 2022-04-09 – 14 Accessible Restricted directory on [bcm-bcaw.mtn.cm] #789388 Valid Information Disclosure Medium 2020-07-15 – 15 Reflected XSS on gamesclub.mtn.com.g #1069528 Valid Cross-site Scripting Medium 2021-05-24 – 15 Reflected XSS at dailydeals.mtn.co.za #1210921 Valid Cross-site Scripting Medium 2021-12-24 – 15 There is no rate limit for SME REGISTRATION PORTAL #1305766 Valid Authentication – 2022-09-19 – 15 Firebase Database Takeover in https://pulseradio.mtn.co.ug/ #1447751 Valid Information Disclosure Critical 2022-12-01 – 15 xss on [developers.mtn.com] #924851 Valid Cross-site Scripting Medium 2022-04-19 – 16 2x Remote file inclusion within your VMware Instances #1069105 Valid File and Path Handling Critical 2021-08-19 – 16 HTML injection in email content during registration via FirstName/LastName parameter #1256496 Valid Cross-site Scripting Medium 2021-12-18 – 16 Unsafe cors sharing of admin users #772744 Valid No weakness recorded Medium 2020-04-30 – 17 Reflected XSS on play.mtn.co.za #1061199 Valid Cross-site Scripting Medium 2021-08-14 – 17