Browse / MTN Group

MTN Group

See its reports on the map

Attack surface: 214,283 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to MTN Group

• Cross-site Scripting26
• Information Disclosure26
• Authentication15
• Access Control12
• Code Execution12
• SQL Injection7

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL Injection on cookie parameterSQL Injection · high
   323 votes
2. SQLi | in URL pathsSQL Injection · critical
   149 votes
3. Yet Another OTP code Leaked in the API ResponseImproper Authentication - Generic · critical
   135 votes
4. IDOR at mtnmobad.mtnbusiness.com.ng leads to PII leakage. Insecure Direct Object Reference (IDOR) · critical
   135 votes
5. FULL ACCOUNT TAKEOVERImproper Authentication - Generic · critical
   123 votes
6. SQL injection in URL path leads to Database AccessSQL Injection · critical
   115 votes
7. Authentication Bypass Leads To Complete Account TakeveOver on ██████████Authentication Bypass Using an Alternate Path or Channel · critical
   109 votes
8. DOM Based Reflected Cross Site ScriptingCross-site Scripting (XSS) - DOM · high
   104 votes
9. Reflected cross site scripting (XSS) attacks Reflected XSS attacks, Cross-site Scripting (XSS) - Reflected · medium
   100 votes
10. Ability to Add and Verify Uncontrolled Mobile Numbers Leading to Account Takeover (ATO)Authentication Bypass Using an Alternate Path or Channel · critical
    98 votes
11. IDOR Leads To User Profile Modification https://mtnmobad.mtnbusiness.com.ng/app/updateUserIncorrect Authorization · critical
    96 votes
12. Improper Access Controls(Admin Path)Improper Access Control - Generic · high
    88 votes
13. Remote code execution [CVE-2023-36845]Code Injection · critical
    87 votes
14. Unauthorized access to PII leads to Administrator account TakeoverPrivilege Escalation · critical
    82 votes
15. Admin Dashboard Access Leads to Updating Merchant InfoImproper Access Control - Generic · critical
    81 votes
16. OTP code Leaked in API Response Improper Access Control - Generic · critical
    81 votes
17. cross site scripting reflected Cross-site Scripting (XSS) - Reflected · medium
    81 votes
18. Broken Access Control leads to disclosure of transaction history via /v2/rechargeTransactionHistory endpointImproper Access Control - Generic · high
    76 votes
19. Reflected XSS in https://nin.mtn.ng/nin/success?message=lol&nin=<VULNERABLE>Cross-site Scripting (XSS) - Reflected · critical
    70 votes
20. Broken Access Control(Horizontal Privilege Escalation).Improper Access Control - Generic · medium
    69 votes
21. Insecure direct Object Reference(Horizontal Escalation)Insecure Direct Object Reference (IDOR) · medium
    66 votes
22. Reflected - XSSCross-site Scripting (XSS) - Reflected · high
    63 votes
23. CVE-2018-0296 Cisco ASA Denial of Service & Path Traversal vulnerable on [mtn.co.ug]Path Traversal: '.../...//' · critical
    62 votes
24. PHP info page disclosure in ██████████Information Disclosure · medium
    62 votes
25. Information disclosure due to debug mode enabled at Laravel instance https://mpos.mtn.co.sz/ Information Disclosure · medium
    61 votes
26. Blind SSRF External Interaction on ████████Server-Side Request Forgery (SSRF) · high
    61 votes
27. SSRF Keycloak before 13.0.0 - CVE-2020-10770 on https://sponsoredata.mtn.ciServer-Side Request Forgery (SSRF) · medium
    60 votes
28. Remote code execution via crafted pentaho report uploaded using default credentials for pentaho business serverCode Injection · critical
    59 votes
29. Information disclosure via enabled Django Debug Mode Information Disclosure · medium
    55 votes
30. Weak/Auto Fill PasswordInsufficiently Protected Credentials · critical
    53 votes
31. No rate limit in OTP code sendingImproper Restriction of Authentication Attempts · medium
    49 votes
32. Cisco IOS XE instance at ████ vulnerable to CVE-██████Command Injection - Generic · critical
    48 votes
33. Exposure Of Admin Username & PasswordInsecure Storage of Sensitive Information · critical
    48 votes
34. CVE-2023-41763 Business Elevation of Privilege vulnerability on [.mtn.com]Command Injection - Generic · high
    47 votes
35. CVE-2017-9822 DotNetNuke Cookie Deserialization Remote Code Execution (RCE) on lonidoor.mtn.ciCode Injection · critical
    46 votes
36. Unauthenticated phpinfo()files could lead to ability file read at █████████ Improper Access Control - Generic · medium
    44 votes
37. Blind SQL Injection SQL Injection · critical
    43 votes
38. CVE-2010-1429 JBoss Insecure Storage of Sensitive Information on ips.mtn.co.ugInsecure Storage of Sensitive Information · high
    42 votes
39. Default Login Credentials on https://broadbandmaps.mtn.com.gh/ Improper Access Control - Generic · critical
    42 votes
40. Social media account takeover Externally Controlled Reference to a Resource in Another Sphere · low
    41 votes
41. Cross-Site Scripting through search form on mtnplay.co.zmCross-site Scripting (XSS) - Generic · low
    40 votes
42. POST BASED REFLECTED XSS IN dailydeals.mtn.co.zaCross-site Scripting (XSS) - Reflected · high
    35 votes
43. Week Passwords generated by password reset functionWeak Password Recovery Mechanism for Forgotten Password · low
    35 votes
44. IDOR Leads To Account Takeover Without User InteractionInsecure Direct Object Reference (IDOR) · critical
    34 votes
45. Cross-site Scripting (XSS) - ReflectedCross-site Scripting (XSS) - Reflected · medium
    34 votes
46. Unauthenticated phpinfo()files could lead to ability file read at h2f54.n1.ips.mtn.co.ug [/dashboard/]Violation of Secure Design Principles · medium
    33 votes
47. Wordpress users Disclosure [ /wp-json/wp/v2/users/ ]Information Disclosure · critical
    33 votes
48. Reflected Cross-Site scripting in : mtn.bjCross-site Scripting (XSS) - Reflected · high
    33 votes
49. information discloure via logs files at ==> https://ihelp.mtnbusiness.com/logfiles/Log_21-06-2021.txtInformation Disclosure · high
    33 votes
50. SQL Injection on the administrator panelSQL Injection · critical
    32 votes
51. Leaking usernames through endpoints WordpressInformation Disclosure · high
    31 votes
52. SharePoint exposed web services in a subdomainImproper Access Control - Generic · medium
    31 votes
53. Remote code injection in Log4j on https://mymtn.mtncongo.net - CVE-2021-44228OS Command Injection · critical
    30 votes
54. Cross-site Scripting (XSS) - Reflected on https://api.mtn.sd/carbon/admin/login.jsp via `msgId` parameter - CVE-2020-17453Cross-site Scripting (XSS) - Reflected · medium
    30 votes
55. Wordpress users Disclosure [ /wp-json/wp/v2/users/ ] Not Resolved () Information Disclosure · critical
    29 votes
56. RCE Apache Struts2 remote command execution (S2-045) on [wifi-partner.mtn.com.gh]Code Injection · high
    29 votes
57. Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-10271]OS Command Injection · critical
    29 votes
58. IDOR [mtnmobad.mtnbusiness.com.ng]Insecure Direct Object Reference (IDOR) · critical
    28 votes
59. Remove Every User, Admin, And Owner Out Of Their Teams on developers.mtn.com via IDOR + Information DisclosureInsecure Direct Object Reference (IDOR) · critical
    28 votes
60. Reflected Cross Site Scripting Cisco ASA on myvpn.mtncameroon.net CVE-2020-3580Cross-site Scripting (XSS) - Reflected · medium
    28 votes
61. Information Disclosure Leads To User Data LeakInformation Disclosure
    25 votes
62. Otp bypass in verifying ninImproper Authentication - Generic · high
    25 votes
63. Cross-Site Request Forgery (CSRF) to xssCross-Site Request Forgery (CSRF) · medium
    25 votes
64. Remote OS Command Execution on Oracle Weblogic server via [CVE-2017-3506]OS Command Injection · critical
    25 votes
65. path traversal vulnerability in Grafana 8.x allows " local file read "Path Traversal · critical
    24 votes
66. XMLRPC, Enabling XPSA and Bruteforce and DOS + A file disclosing installer-logs.Uncontrolled Resource Consumption · high
    24 votes
67. Authentication bypass in ████████Authentication Bypass Using an Alternate Path or Channel · critical
    23 votes
68. RXSS - http://macademy.mtnonline.comCross-site Scripting (XSS) - Reflected · medium
    23 votes
69. Reflected XSS on mtnhottseat.mtn.com.ghCross-site Scripting (XSS) - Reflected · medium
    22 votes
70. Download full backup [Mtn.co.rw]critical
    21 votes
71. Firebase credentials leakInformation Disclosure
    20 votes
72. Email verification bypassed during sing up (████████)Violation of Secure Design Principles · medium
    20 votes
73. Reflected XSS on dailydeals.mtn.co.zaCross-site Scripting (XSS) - Reflected · medium
    19 votes
74. OTP bypass - Unintended disclosure of OTP to client allows attacker to manage users' subscriptionsIncorrect Authorization · medium
    19 votes
75. PHP Info Exposing Secrets at https://radio.mtn.bj/infoInformation Disclosure · high
    18 votes
76. [mtn.com.af] Multiple vulnerabilities allow to Application level DoSBusiness Logic Errors · high
    18 votes
77. Remote code injection in Log4j on http://mtn1app.mtncameroon.net - CVE-2021-44228OS Command Injection · critical
    17 votes
78. Cross-site Scripting (XSS) - Reflected on http://callertunez.mtn.com.gh/wap/noauth/sharedetail.ftl via `callback` parameter Cross-site Scripting (XSS) - Reflected · medium
    17 votes
79. Reflected XSS on play.mtn.co.zaCross-site Scripting (XSS) - Reflected · medium
    17 votes
80. Unsafe cors sharing of admin users Misconfiguration · medium
    17 votes
81. HTML injection in email content during registration via FirstName/LastName parameterImproper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) · medium
    16 votes
82. 2x Remote file inclusion within your VMware InstancesRemote File Inclusion · critical
    16 votes
83. xss on [developers.mtn.com]Cross-site Scripting (XSS) - Reflected · medium
    16 votes
84. Firebase Database Takeover in https://pulseradio.mtn.co.ug/Insecure Storage of Sensitive Information · critical
    15 votes
85. There is no rate limit for SME REGISTRATION PORTALImproper Authentication - Generic
    15 votes
86. Reflected XSS at dailydeals.mtn.co.zaCross-site Scripting (XSS) - Reflected · medium
    15 votes
87. Reflected XSS on gamesclub.mtn.com.gCross-site Scripting (XSS) - Generic · medium
    15 votes
88. Accessible Restricted directory on [bcm-bcaw.mtn.cm]Information Exposure Through Directory Listing · medium
    15 votes
89. Insecure Storage of Sensitive Information on lonestarcell.com serverInsecure Storage of Sensitive Information · critical
    14 votes
90. cross site scripting in : mtn.bjCross-site Scripting (XSS) - Reflected · high
    14 votes
91. No rate limit in otp code sendingViolation of Secure Design Principles · medium
    14 votes
92. Unprotected Direct Object ReferenceInsecure Direct Object Reference (IDOR) · critical
    13 votes
93. Sensitive Information Disclosure Through Config FileCleartext Storage of Sensitive Information · high
    13 votes
94. Password reset token leak on third party website via Referer header [██████████]Improper Authentication - Generic · medium
    13 votes
95. No rate limit lead to otp brute forcingImproper Restriction of Authentication Attempts · high
    13 votes
96. Information Disclosure FrontPage Configuration Information /_vti_inf.html in https://www.mtn.co.za/Improper Access Control - Generic · medium
    13 votes
97. Account Take over of millions of MTN users account due to lack of Rate limiting when sending OTP codeImproper Authentication - Generic · high
    13 votes
98. Open redirection at https://smartreports.mtncameroon.netOpen Redirect · low
    12 votes
99. firebase credentials leaks @ https://mpulse.mtnonline.com Information Disclosure · medium
    12 votes
100. Remote code execution due to unvalidated file uploadImproper Input Validation · critical
     12 votes