Bug bounty program
AC
Acronis
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection in agent-managerAnalysed#962889 | SQL Injection | 2021-08-16 | – | 237 |
| bypass sql injection #1109311Analysed#1224660 | SQL Injection | 2021-10-05 | – | 164 |
| IDOR vulnerability (Price manipulation)Analysed#1403176 | Insecure Direct Object Reference | 2021-11-30 | – | 146 |
| Ticket Trick at https://account.acronis.comAnalysed#999765 | Access Control | 2020-11-10 | – | 142 |
| [oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943 | Cross-site Scripting | 2024-12-28 | $100 | 134 |
| IP restriction bypass via X-Forwarded-For headerAnalysed#1224089 | Access Control | 2024-12-05 | $250 | 126 |
| Stored XSS in backup scanning plan nameAnalysed#961046 | Cross-site Scripting | 2021-06-28 | $500 | 120 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | SQL Injection | 2021-06-22 | $250 | 118 |
| Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Analysed#1124974 | Access Control | 2022-02-08 | – | 109 |
| Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062 | No weakness recorded | 2024-11-28 | – | 106 |
Subdomains2,285
| Name | Scope | First seen |
|---|---|---|
| auth.acronis.comauth | In scope | 2026-11-14 |
| www.auth.acronis.comauth | In scope | 2026-11-14 |
| cas.acronis.comauth | In scope | 2026-11-14 |
| www.cas.acronis.comauth | In scope | 2026-11-14 |
| sg-cas.apj.corp.acronis.comauth, internal | In scope | 2026-11-14 |
| de-cas.emea.corp.acronis.comauth, internal | In scope | 2026-11-14 |
| cas.us.corp.acronis.comauth, internal | In scope | 2026-11-14 |
| dev3-login.acronis.comauth, dev | In scope | 2026-11-14 |
| login.jp-pp.acronis.comauth | In scope | 2026-11-14 |
| login.acronis.comauth | In scope | 2026-11-14 |
| www.login.acronis.comauth | In scope | 2026-11-14 |
| okta-test.acronis.comauth, test | In scope | 2026-11-14 |
| www.okta-test.acronis.comauth, test | In scope | 2026-11-14 |
| 004553.werp-okta-test.acep.acronis.workauth, test | In scope | 2026-11-14 |
2,283 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.