Browse / CS Money

CS Money

See its reports on the map

What gets reported to CS Money

• Authentication7
• Denial of Service4
• Access Control3
• Misconfiguration2
• Cross-site Scripting1
• Insecure Direct Object Reference1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Blind XSS on image uploadCross-site Scripting (XSS) - Stored · critical
   $1,000450 votes
2. [cs.money] Open Redirect Leads to Account TakeoverImproper Authentication - Generic · medium
   357 votes
3. IDOR in https://3d.cs.money/Insecure Direct Object Reference (IDOR) · medium
   127 votes
4. Html injection on subscription emailFailure to Sanitize Special Elements into a Different Plane (Special Element Injection) · medium
   $30077 votes
5. Authentication Bypass to (CVE-2023-2982)Authentication Bypass Using an Alternate Path or Channel · low
   $10074 votes
6. Отправка писем с произвольным текстом/кликабельными ссылками любому зарегистрированному пользователю с указанной почтой, зная только steamidReliance on Cookies without Validation and Integrity Checking in a Security Decision · critical
   74 votes
7. Able to blocking users with 2fa from login into their accounts by just knowing the SteamIDReliance on Cookies without Validation and Integrity Checking in a Security Decision · medium
   $30070 votes
8. Attacker can generate cancelled transctions in a user's transaction history using only Steam IDImproper Authorization · medium
   $30066 votes
9. Bypass restrict of member subscription to use custom background in https://3d.cs.money without prime subscriptionImproper Access Control - Generic · medium
   48 votes
10. Application DOS via specially crafted payload on 3d.cs.moneyUncontrolled Resource Consumption · medium
    36 votes
11. Site-wide CSRF on Safari due to CORS misconfiguration (not localhost)Cross-Site Request Forgery (CSRF) · medium
    $30033 votes
12. Cookie poisoning leads to DOS and Privacy ViolationPrivacy Violation · high
    $70030 votes
13. Content Spoofing/Text Injection in https://support.cs.money and JS file not minified and uglyfied which makes it clearly readable User Interface (UI) Misrepresentation of Critical Information · low
    28 votes
14. Bypass Filter on link of buildImproper Access Control - Generic · low
    28 votes
15. Pixel Flood Attack leads to Application level DoSUncontrolled Resource Consumption · low
    $20026 votes
16. Blind Based SQL Injection in 3d.sc.moneyInformativeSQL Injection
    23 votes
17. Server-side denial of service via large payload sent to wiki.cs.money/graphqlDenial of Service
    16 votes
18. ReDoS at wiki.cs.money graphQL endpoint (AND probably a kind of command injection)Uncontrolled Resource Consumption · medium
    $25015 votes
19. Origin IP found, Cloudflare bypassedN/AViolation of Secure Design Principles · medium
    11 votes
20. Previously created sessions continue being valid after MFA activationInformativeImproper Authentication - Generic · medium
    10 votes
21. Manipulate Uneditable Messages in SupportInformativeBusiness Logic Errors · high
    9 votes
22. Able to upload backgrounds before entering 2FAInformativeImproper Authentication - Generic · medium
    5 votes
23. Improper authentication in the load sell inventory pageInformativeImproper Authentication - Generic
    3 votes