Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQLi | in URL pathsAnalysed#2958619 | Valid | SQL Injection | Critical | 2025-03-06 | – | 149 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Valid | Authentication | Critical | 2025-01-08 | – | 135 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Valid | Insecure Direct Object Reference | Critical | 2024-10-05 | – | 135 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Valid | Authentication | Critical | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Valid | Cross-site Scripting | High | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Valid | Cross-site Scripting | Medium | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Valid | Authentication | Critical | 2025-03-04 | – | 98 |
| Improper Access Controls(Admin Path)Analysed#2342461 | Valid | Access Control | High | 2025-01-31 | – | 88 |
| Remote code execution [CVE-2023-36845]Analysed#2182202 | Valid | No weakness recorded | Critical | 2024-10-09 | – | 87 |
| Unauthorized access to PII leads to Administrator account TakeoverAnalysed#2450685 | Valid | Access Control | Critical | 2025-02-22 | – | 82 |
| Admin Dashboard Access Leads to Updating Merchant InfoAnalysed#2801787 | Valid | Access Control | Critical | 2025-03-02 | – | 81 |
| OTP code Leaked in API ResponseAnalysed#2633888 | Valid | Access Control | Critical | 2025-01-08 | – | 81 |
| cross site scripting reflectedAnalysed#1496897 | Valid | Cross-site Scripting | Medium | 2024-09-09 | – | 81 |
| Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE>Analysed#2039384 | Valid | Cross-site Scripting | Critical | 2024-10-05 | – | 70 |
| Reflected - XSSAnalysed#1779447 | Valid | Cross-site Scripting | High | 2024-10-21 | – | 63 |
| CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]Analysed#2375666 | Valid | File and Path Handling | Critical | 2024-08-30 | – | 62 |
| PHP info page disclosure in ██████████Analysed#1848780 | Valid | No weakness recorded | Medium | 2024-08-30 | – | 62 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | Information Disclosure | Medium | 2025-02-23 | – | 61 |
| Blind SSRF External Interaction on ████████Analysed#1220688 | Valid | Server-Side Request Forgery | High | 2022-08-21 | – | 61 |
| SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciAnalysed#1379080 | Valid | Server-Side Request Forgery | Medium | 2024-09-26 | – | 60 |
| Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business serverAnalysed#1677047 | Valid | Command and Code Injection | Critical | 2023-12-31 | – | 59 |
| Information disclosure via enabled Django Debug ModeAnalysed#2201370 | Valid | Information Disclosure | Medium | 2024-12-25 | – | 55 |
| Weak/Auto Fill PasswordAnalysed#817331 | Valid | Authentication | Critical | 2022-09-03 | – | 53 |
| Cisco IOS XE instance at ████ vulnerable to CVE-██████Analysed#2778350 | Valid | Command and Code Injection | Critical | 2025-02-19 | – | 48 |
| Exposure Of Admin Username & PasswordAnalysed#1703733 | Valid | Information Disclosure | Critical | 2022-12-25 | – | 48 |
| CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com]Analysed#2309291 | Valid | Command and Code Injection | High | 2025-02-22 | – | 47 |
| CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ciAnalysed#2762119 | Valid | Command and Code Injection | Critical | 2024-11-16 | – | 46 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (2,190 analysed so far), which can be wrong. Data as of 2026-11-15.