Bug bounty program
AC
Acronis
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection in agent-managerAnalysed#962889 | SQL Injection | 2021-08-16 | – | 237 |
| bypass sql injection #1109311Analysed#1224660 | SQL Injection | 2021-10-05 | – | 164 |
| IDOR vulnerability (Price manipulation)Analysed#1403176 | Insecure Direct Object Reference | 2021-11-30 | – | 146 |
| Ticket Trick at https://account.acronis.comAnalysed#999765 | Access Control | 2020-11-10 | – | 142 |
| [oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943 | Cross-site Scripting | 2024-12-28 | $100 | 134 |
| IP restriction bypass via X-Forwarded-For headerAnalysed#1224089 | Access Control | 2024-12-05 | $250 | 126 |
| Stored XSS in backup scanning plan nameAnalysed#961046 | Cross-site Scripting | 2021-06-28 | $500 | 120 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | SQL Injection | 2021-06-22 | $250 | 118 |
| Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Analysed#1124974 | Access Control | 2022-02-08 | – | 109 |
| Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062 | No weakness recorded | 2024-11-28 | – | 106 |
Subdomains2,285
| Name | Scope | First seen |
|---|---|---|
| ftp.devicelock.comdata | In scope | 2026-11-14 |
| ru.ftp.devicelock.comdata | In scope | 2026-11-14 |
2,283 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.