Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Blind XSS on image uploadAnalysed#1010466 | Valid | Cross-site Scripting | Critical | 2020-12-26 | $1,000 | 450 |
| IDOR in https://3d.cs.money/Analysed#990878 | Valid | Insecure Direct Object Reference | Medium | 2020-09-28 | – | 127 |
| Able to blocking users with 2fa from login into their accounts by just knowing the SteamIDAnalysed#1179232 | Valid | Input Validation and Logic | Medium | 2023-12-14 | $300 | 70 |
| Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscriptionAnalysed#989415 | Valid | No weakness recorded | Medium | 2020-09-28 | – | 48 |
| Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)Analysed#975983 | Valid | Cross-Site Request Forgery | Medium | 2020-10-27 | $300 | 33 |
| Cookie poisoning leads to DOS and Privacy ViolationAnalysed#1067809 | Valid | Information Disclosure | High | 2021-02-25 | $700 | 30 |
| Bypass Filter on link of buildAnalysed#990838 | Valid | No weakness recorded | Low | 2020-09-28 | – | 28 |
| Pixel Flood Attack leads to Application level DoSAnalysed#970760 | Valid | Denial of Service | Low | 2020-11-05 | $200 | 26 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.