Bug bounty program

CS Money

Most upvoted reports23

Most upvoted reports of CS Money
Report	Weakness	Disclosed	Bounty	Votes
Blind XSS on image uploadAnalysed#1010466	Cross-site Scripting	2020-12-26	$1,000	450
[cs.money] Open Redirect Leads to Account TakeoverAnalysed#905607	Authentication	2020-09-30	–	357
IDOR in https://3d.cs.money/#990878	Insecure Direct Object Reference	2020-09-28	–	127
Html injection on subscription email#1108504	Injection and Smuggling	2024-01-23	$300	77
Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamid#993711	Input Validation and Logic	2020-12-20	–	74
Authentication Bypass to (CVE-2023-2982)#2269989	Authentication	2023-12-08	$100	74
Able to blocking users with 2fa from login into their accounts by just knowing the SteamID#1179232	Input Validation and Logic	2023-12-14	$300	70
Attacker can generate cancelled transctions in a user's transaction history using only Steam ID#1021776	Access Control	2021-02-03	$300	66
Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription#989415	No weakness recorded	2020-09-28	–	48
Application DOS via specially crafted payload on 3d.cs.money#993582	No weakness recorded	2020-10-01	–	36

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.