Improper authentication in the load sell inventory page #993767 Informative Authentication – 2020-10-08 – 3 Able to upload backgrounds before entering 2FA #1080839 Informative Authentication – 2021-02-03 – 5 Manipulate Uneditable Messages in Support #995969 Informative Input Validation and Logic – 2020-10-27 – 9 Previously created sessions continue being valid after MFA activation #1185479 Informative No weakness recorded – 2021-05-18 – 10 Origin IP found, Cloudflare bypassed #1105673 N/A Misconfiguration and Insecure Design – 2021-03-30 – 11 ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection) #1000567 Valid Denial of Service – 2020-10-27 $250 15 Server-side denial of service via large payload sent to wiki.cs.money/graphql #993005 Not checked yet Denial of Service – – – 16 Blind Based SQL Injection in 3d.sc.money #1107536 Informative SQL Injection – 2021-04-16 – 23 Pixel Flood Attack leads to Application level DoS #970760 Valid Denial of Service – 2020-11-05 $200 26 Bypass Filter on link of build #990838 Valid No weakness recorded – 2020-09-28 – 28 Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable #997198 Valid Input Validation and Logic – 2020-11-12 – 28 Cookie poisoning leads to DOS and Privacy Violation #1067809 Valid Information Disclosure – 2021-02-25 $700 30 Site-wide CSRF on Safari due to CORS misconfiguration (not localhost) #975983 Valid Cross-Site Request Forgery – 2020-10-27 $300 33 Application DOS via specially crafted payload on 3d.cs.money #993582 Valid No weakness recorded – 2020-10-01 – 36 Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscription #989415 Valid No weakness recorded – 2020-09-28 – 48 Attacker can generate cancelled transctions in a user's transaction history using only Steam ID #1021776 Valid Access Control – 2021-02-03 $300 66 Able to blocking users with 2fa from login into their accounts by just knowing the SteamID #1179232 Valid Input Validation and Logic – 2023-12-14 $300 70 Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamid #993711 Valid Input Validation and Logic – 2020-12-20 – 74 Authentication Bypass to (CVE-2023-2982) #2269989 Valid Authentication Low 2023-12-08 $100 74 Html injection on subscription email #1108504 Valid Injection and Smuggling – 2024-01-23 $300 77 IDOR in https://3d.cs.money/ Analysed #990878 Valid Insecure Direct Object Reference – 2020-09-28 – 127 [cs.money] Open Redirect Leads to Account Takeover Analysed #905607 Valid Authentication – 2020-09-30 – 357 Blind XSS on image upload Analysed #1010466 Valid Cross-site Scripting – 2020-12-26 $1,000 450