Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | Valid | SQL Injection | Critical | 2025-01-08 | – | 115 |
| IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUserAnalysed#1714638 | Valid | Access Control | Critical | 2024-09-18 | – | 96 |
| Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointAnalysed#2746709 | Valid | No weakness recorded | High | 2025-03-02 | – | 76 |
| Broken Access Control(Horizontal Privilege Escalation).Analysed#2319586 | Valid | Access Control | Medium | 2025-01-31 | – | 69 |
| Insecure direct Object Reference(Horizontal Escalation)Analysed#2322663 | Valid | Insecure Direct Object Reference | Medium | 2025-01-31 | – | 66 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,443 analysed so far), which can be wrong. Data as of 2026-11-14.