Bug bounty program
AC
Acronis
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection in agent-managerAnalysed#962889 | SQL Injection | 2021-08-16 | – | 237 |
| bypass sql injection #1109311Analysed#1224660 | SQL Injection | 2021-10-05 | – | 164 |
| IDOR vulnerability (Price manipulation)Analysed#1403176 | Insecure Direct Object Reference | 2021-11-30 | – | 146 |
| Ticket Trick at https://account.acronis.comAnalysed#999765 | Access Control | 2020-11-10 | – | 142 |
| [oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943 | Cross-site Scripting | 2024-12-28 | $100 | 134 |
| IP restriction bypass via X-Forwarded-For headerAnalysed#1224089 | Access Control | 2024-12-05 | $250 | 126 |
| Stored XSS in backup scanning plan nameAnalysed#961046 | Cross-site Scripting | 2021-06-28 | $500 | 120 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | SQL Injection | 2021-06-22 | $250 | 118 |
| Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Analysed#1124974 | Access Control | 2022-02-08 | – | 109 |
| Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062 | No weakness recorded | 2024-11-28 | – | 106 |
Subdomains2,285
| Name | Scope | First seen |
|---|---|---|
| staging.5nine.comstaging | In scope | 2026-11-14 |
| a-preview.acronis.comstaging | In scope | 2026-11-14 |
| agents-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| agents-mc-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| asign-preview.acronis.comstaging | In scope | 2026-11-14 |
| beta-baas.acronis.comstaging | In scope | 2026-11-14 |
| beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| beta-forum.acronis.comstaging | In scope | 2026-11-14 |
| beta-report.acronis.comstaging | In scope | 2026-11-14 |
| beta-s3gw.acronis.comstaging | In scope | 2026-11-14 |
| www.beta-s3gw.acronis.comstaging | In scope | 2026-11-14 |
| beta1-baas.acronis.comstaging | In scope | 2026-11-14 |
| beta1-cloud.acronis.comstaging | In scope | 2026-11-14 |
| beta2-cloud.acronis.comstaging | In scope | 2026-11-14 |
| branded-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| cloud-rs-beta.acronis.comstaging | In scope | 2026-11-14 |
| cloud-rs-preview1.acronis.comstaging | In scope | 2026-11-14 |
| www.cloud-rs-preview1.acronis.comstaging | In scope | 2026-11-14 |
| cloud-wr-beta.acronis.comstaging | In scope | 2026-11-14 |
| cloud-wre-preview1.acronis.comstaging | In scope | 2026-11-14 |
| cloud-wrh-preview1.acronis.comstaging | In scope | 2026-11-14 |
| www.cloud-wrh-preview1.acronis.comstaging | In scope | 2026-11-14 |
| ipn-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| alpha.jp-pp.acronis.comstaging | In scope | 2026-11-14 |
| stg.jp-pp.acronis.comstaging | In scope | 2026-11-14 |
| mc-beta-baas.acronis.comstaging | In scope | 2026-11-14 |
| mc-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| mc-beta1-baas.acronis.comstaging | In scope | 2026-11-14 |
| mobile-backup-server-beta.acronis.comdata, staging | In scope | 2026-11-14 |
| notary-preview.acronis.comstaging | In scope | 2026-11-14 |
| www.notary-preview.acronis.comstaging | In scope | 2026-11-14 |
| preprod.partners.acronis.comstaging | In scope | 2026-11-14 |
| staging.partners.acronis.comstaging | In scope | 2026-11-14 |
| tm.staging.partners.acronis.comstaging | In scope | 2026-11-14 |
| preview1.acronis.comstaging | In scope | 2026-11-14 |
| rs-beta-baas.acronis.comstaging | In scope | 2026-11-14 |
| rs-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| rs-beta1-cloud.acronis.comstaging | In scope | 2026-11-14 |
| s3-staging-us2.acronis.comdata, staging | In scope | 2026-11-14 |
| fw.s3-staging-us2.acronis.comdata, staging | In scope | 2026-11-14 |
| snactivation-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| staging-snactivation.acronis.comstaging | In scope | 2026-11-14 |
| ti-beta-cloud.acronis.comstaging | In scope | 2026-11-14 |
| grafana.beta-baas.acronis.workmonitoring, staging | In scope | 2026-11-14 |
| db.beta-cloud.acronis.workdata, staging | In scope | 2026-11-14 |
| grafana.beta-cloud.acronis.workmonitoring, staging | In scope | 2026-11-14 |
| k8s.beta-cloud.acronis.workstaging, tools | In scope | 2026-11-14 |
| prometheus.beta-cloud.acronis.workmonitoring, staging | In scope | 2026-11-14 |
| stage.cbc.acronis.workstaging | In scope | 2026-11-14 |
| h1-beta-cloud.acronis.workstaging | In scope | 2026-11-14 |
| www-staging.devicelock.comstaging | In scope | 2026-11-14 |
2,283 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.