SQL Injection on cookie parameter Analysed #761304 Valid SQL Injection – 2020-05-03 – 323 SQLi | in URL paths #2958619 Valid SQL Injection Critical 2025-03-06 – 149 Yet Another OTP code Leaked in the API Response #2635315 Valid Authentication Critical 2025-01-08 – 135 IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage. #1773609 Valid Insecure Direct Object Reference Critical 2024-10-05 – 135 FULL ACCOUNT TAKEOVER #2542372 Valid No weakness recorded Critical 2024-08-17 – 123 SQL injection in URL path leads to Database Access #2633959 Valid SQL Injection Critical 2025-01-08 – 115 Authentication Bypass Leads To Complete Account TakeveOver on ██████████ #1709881 Valid Authentication Critical 2024-09-14 – 109 DOM Based Reflected Cross Site Scripting #2321874 Valid Cross-site Scripting High 2024-12-25 – 104 Reflected cross site scripting (XSS) attacks Reflected XSS attacks, #1799197 Valid Cross-site Scripting Medium 2024-08-30 – 100 Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO) #2762462 Valid Authentication Critical 2025-03-04 – 98 IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUser #1714638 Valid Access Control Critical 2024-09-18 – 96 Improper Access Controls(Admin Path) #2342461 Valid Access Control High 2025-01-31 – 88 Remote code execution [CVE-2023-36845] #2182202 Valid No weakness recorded Critical 2024-10-09 – 87 Unauthorized access to PII leads to Administrator account Takeover #2450685 Valid Access Control Critical 2025-02-22 – 82 Admin Dashboard Access Leads to Updating Merchant Info #2801787 Valid Access Control Critical 2025-03-02 – 81 OTP code Leaked in API Response #2633888 Valid Access Control Critical 2025-01-08 – 81 cross site scripting reflected #1496897 Valid Cross-site Scripting Medium 2024-09-09 – 81 Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpoint #2746709 Valid No weakness recorded High 2025-03-02 – 76 Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE> #2039384 Valid Cross-site Scripting Critical 2024-10-05 – 70 Broken Access Control(Horizontal Privilege Escalation). #2319586 Valid Access Control Medium 2025-01-31 – 69 Insecure direct Object Reference(Horizontal Escalation) #2322663 Valid Insecure Direct Object Reference Medium 2025-01-31 – 66 Reflected - XSS #1779447 Valid Cross-site Scripting High 2024-10-21 – 63 CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug] #2375666 Valid File and Path Handling Critical 2024-08-30 – 62 PHP info page disclosure in ██████████ #1848780 Valid No weakness recorded Medium 2024-08-30 – 62 Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/ #2765259 Valid Information Disclosure Medium 2025-02-23 – 61 Blind SSRF External Interaction on ████████ #1220688 Valid Server-Side Request Forgery – 2022-08-21 – 61 SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ci #1379080 Valid Server-Side Request Forgery Medium 2024-09-26 – 60 Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business server #1677047 Valid Command and Code Injection – 2023-12-31 – 59 Information disclosure via enabled Django Debug Mode #2201370 Valid Information Disclosure Medium 2024-12-25 – 55 Weak/Auto Fill Password #817331 Valid Authentication – 2022-09-03 – 53 No rate limit in OTP code sending #1780399 Valid No weakness recorded Medium 2024-10-21 – 49 Cisco IOS XE instance at ████ vulnerable to CVE-██████ #2778350 Valid Command and Code Injection Critical 2025-02-19 – 48 Exposure Of Admin Username & Password #1703733 Valid Information Disclosure – 2022-12-25 – 48 CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com] #2309291 Valid Command and Code Injection High 2025-02-22 – 47 CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ci #2762119 Valid Command and Code Injection Critical 2024-11-16 – 46 Unauthenticated phpinfo()files could lead to ability file read at █████████ #2764952 Valid Access Control Medium 2024-11-15 – 44 Blind SQL Injection #1069531 Valid SQL Injection – 2021-08-14 – 43 CVE-2010-1429 JBoss Insecure Storage of Sensitive Information on ips.mtn.co.ug #2375659 Valid Information Disclosure High 2024-08-30 – 42 Default Login Credentials on https://broadbandmaps.mtn.com.gh/ #1297480 Valid Access Control – 2022-08-25 – 42 Social media account takeover #2682974 Valid Server-Side Request Forgery Low 2024-11-03 – 41 Cross-Site Scripting through search form on mtnplay.co.zm #761573 Valid Cross-site Scripting – 2021-06-08 – 40 POST BASED REFLECTED XSS IN dailydeals.mtn.co.za #1451394 Valid Cross-site Scripting – 2022-07-15 – 35 Week Passwords generated by password reset function #765031 Valid Authentication – 2020-05-09 – 35 IDOR Leads To Account Takeover Without User Interaction #1272478 Valid Insecure Direct Object Reference – 2022-09-04 – 34 Cross-site Scripting (XSS) - Reflected #1183336 Valid Cross-site Scripting – 2022-10-30 – 34 Unauthenticated phpinfo()files could lead to ability file read at h2f54.n1.ips.mtn.co.ug [/dashboard/] #2610478 Valid Misconfiguration and Insecure Design Medium 2025-02-20 – 33 Wordpress users Disclosure [ /wp-json/wp/v2/users/ ] #1735586 Valid Information Disclosure – 2022-11-27 – 33 Reflected Cross-Site scripting in : mtn.bj #1264832 Valid Cross-site Scripting – 2021-09-26 – 33 information discloure via logs files at ==> https://ihelp.mtnbusiness.com/logfiles/Log_21-06-2021.txt #1239633 Valid Information Disclosure – 2021-08-20 – 33 SQL Injection on the administrator panel #865436 Valid SQL Injection – 2021-07-29 – 32