Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL Injection on cookie parameterAnalysed#761304 | Valid | SQL Injection | High | 2020-05-03 | – | 323 |
| SQLi | in URL pathsAnalysed#2958619 | Valid | SQL Injection | Critical | 2025-03-06 | – | 149 |
| Yet Another OTP code Leaked in the API ResponseAnalysed#2635315 | Valid | Authentication | Critical | 2025-01-08 | – | 135 |
| IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage.Analysed#1773609 | Valid | Insecure Direct Object Reference | Critical | 2024-10-05 | – | 135 |
| FULL ACCOUNT TAKEOVERAnalysed#2542372 | Valid | No weakness recorded | Critical | 2024-08-17 | – | 123 |
| SQL injection in URL path leads to Database AccessAnalysed#2633959 | Valid | SQL Injection | Critical | 2025-01-08 | – | 115 |
| Authentication Bypass Leads To Complete Account TakeveOver on ██████████Analysed#1709881 | Valid | Authentication | Critical | 2024-09-14 | – | 109 |
| DOM Based Reflected Cross Site ScriptingAnalysed#2321874 | Valid | Cross-site Scripting | High | 2024-12-25 | – | 104 |
| Reflected cross site scripting (XSS) attacks Reflected XSS attacks,Analysed#1799197 | Valid | Cross-site Scripting | Medium | 2024-08-30 | – | 100 |
| Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Analysed#2762462 | Valid | Authentication | Critical | 2025-03-04 | – | 98 |
| IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUserAnalysed#1714638 | Valid | Access Control | Critical | 2024-09-18 | – | 96 |
| Improper Access Controls(Admin Path)Analysed#2342461 | Valid | Access Control | High | 2025-01-31 | – | 88 |
| Remote code execution [CVE-2023-36845]Analysed#2182202 | Valid | No weakness recorded | Critical | 2024-10-09 | – | 87 |
| Unauthorized access to PII leads to Administrator account TakeoverAnalysed#2450685 | Valid | Access Control | Critical | 2025-02-22 | – | 82 |
| Admin Dashboard Access Leads to Updating Merchant InfoAnalysed#2801787 | Valid | Access Control | Critical | 2025-03-02 | – | 81 |
| OTP code Leaked in API ResponseAnalysed#2633888 | Valid | Access Control | Critical | 2025-01-08 | – | 81 |
| cross site scripting reflectedAnalysed#1496897 | Valid | Cross-site Scripting | Medium | 2024-09-09 | – | 81 |
| Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointAnalysed#2746709 | Valid | No weakness recorded | High | 2025-03-02 | – | 76 |
| Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE>Analysed#2039384 | Valid | Cross-site Scripting | Critical | 2024-10-05 | – | 70 |
| Broken Access Control(Horizontal Privilege Escalation).Analysed#2319586 | Valid | Access Control | Medium | 2025-01-31 | – | 69 |
| Insecure direct Object Reference(Horizontal Escalation)Analysed#2322663 | Valid | Insecure Direct Object Reference | Medium | 2025-01-31 | – | 66 |
| Reflected - XSSAnalysed#1779447 | Valid | Cross-site Scripting | High | 2024-10-21 | – | 63 |
| CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]Analysed#2375666 | Valid | File and Path Handling | Critical | 2024-08-30 | – | 62 |
| PHP info page disclosure in ██████████Analysed#1848780 | Valid | No weakness recorded | Medium | 2024-08-30 | – | 62 |
| Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/Analysed#2765259 | Valid | Information Disclosure | Medium | 2025-02-23 | – | 61 |
| Blind SSRF External Interaction on ████████Analysed#1220688 | Valid | Server-Side Request Forgery | High | 2022-08-21 | – | 61 |
| SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciAnalysed#1379080 | Valid | Server-Side Request Forgery | Medium | 2024-09-26 | – | 60 |
| Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business serverAnalysed#1677047 | Valid | Command and Code Injection | Critical | 2023-12-31 | – | 59 |
| Information disclosure via enabled Django Debug ModeAnalysed#2201370 | Valid | Information Disclosure | Medium | 2024-12-25 | – | 55 |
| Weak/Auto Fill PasswordAnalysed#817331 | Valid | Authentication | Critical | 2022-09-03 | – | 53 |
| No rate limit in OTP code sendingAnalysed#1780399 | Valid | No weakness recorded | Medium | 2024-10-21 | – | 49 |
| Cisco IOS XE instance at ████ vulnerable to CVE-██████Analysed#2778350 | Valid | Command and Code Injection | Critical | 2025-02-19 | – | 48 |
| Exposure Of Admin Username & PasswordAnalysed#1703733 | Valid | Information Disclosure | Critical | 2022-12-25 | – | 48 |
| CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com]Analysed#2309291 | Valid | Command and Code Injection | High | 2025-02-22 | – | 47 |
| CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ciAnalysed#2762119 | Valid | Command and Code Injection | Critical | 2024-11-16 | – | 46 |
| Unauthenticated phpinfo()files could lead to ability file read at █████████Analysed#2764952 | Valid | Access Control | Medium | 2024-11-15 | – | 44 |
| Blind SQL InjectionAnalysed#1069531 | Valid | SQL Injection | Critical | 2021-08-14 | – | 43 |
| CVE-2010-1429 JBoss Insecure Storage of Sensitive Information on ips.mtn.co.ugAnalysed#2375659 | Valid | Information Disclosure | High | 2024-08-30 | – | 42 |
| Default Login Credentials on https://broadbandmaps.mtn.com.gh/Analysed#1297480 | Valid | Access Control | Critical | 2022-08-25 | – | 42 |
| Social media account takeoverAnalysed#2682974 | Valid | Server-Side Request Forgery | Low | 2024-11-03 | – | 41 |
| Cross-Site Scripting through search form on mtnplay.co.zmAnalysed#761573 | Valid | Cross-site Scripting | Low | 2021-06-08 | – | 40 |
| POST BASED REFLECTED XSS IN dailydeals.mtn.co.zaAnalysed#1451394 | Valid | Cross-site Scripting | High | 2022-07-15 | – | 35 |
| Week Passwords generated by password reset functionAnalysed#765031 | Valid | Authentication | Low | 2020-05-09 | – | 35 |
| IDOR Leads To Account Takeover Without User InteractionAnalysed#1272478 | Valid | Insecure Direct Object Reference | Critical | 2022-09-04 | – | 34 |
| Cross-site Scripting (XSS) - ReflectedAnalysed#1183336 | Valid | Cross-site Scripting | Medium | 2022-10-30 | – | 34 |
| Unauthenticated phpinfo()files could lead to ability file read at h2f54.n1.ips.mtn.co.ug [/dashboard/]Analysed#2610478 | Valid | Misconfiguration and Insecure Design | Medium | 2025-02-20 | – | 33 |
| Wordpress users Disclosure [ /wp-json/wp/v2/users/ ]Analysed#1735586 | Valid | Information Disclosure | Critical | 2022-11-27 | – | 33 |
| Reflected Cross-Site scripting in : mtn.bjAnalysed#1264832 | Valid | Cross-site Scripting | High | 2021-09-26 | – | 33 |
| information discloure via logs files at ==> https://ihelp.mtnbusiness.com/logfiles/Log_21-06-2021.txtAnalysed#1239633 | Valid | Information Disclosure | High | 2021-08-20 | – | 33 |
| SQL Injection on the administrator panelAnalysed#865436 | Valid | SQL Injection | Critical | 2021-07-29 | – | 32 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.