Bug bounty program
AC
Acronis
Most upvoted reports128
All reports| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| SQL Injection in agent-managerAnalysed#962889 | SQL Injection | 2021-08-16 | – | 237 |
| bypass sql injection #1109311Analysed#1224660 | SQL Injection | 2021-10-05 | – | 164 |
| IDOR vulnerability (Price manipulation)Analysed#1403176 | Insecure Direct Object Reference | 2021-11-30 | – | 146 |
| Ticket Trick at https://account.acronis.comAnalysed#999765 | Access Control | 2020-11-10 | – | 142 |
| [oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943 | Cross-site Scripting | 2024-12-28 | $100 | 134 |
| IP restriction bypass via X-Forwarded-For headerAnalysed#1224089 | Access Control | 2024-12-05 | $250 | 126 |
| Stored XSS in backup scanning plan nameAnalysed#961046 | Cross-site Scripting | 2021-06-28 | $500 | 120 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | SQL Injection | 2021-06-22 | $250 | 118 |
| Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Analysed#1124974 | Access Control | 2022-02-08 | – | 109 |
| Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062 | No weakness recorded | 2024-11-28 | – | 106 |
Subdomains2,285
| Name | Scope | First seen |
|---|---|---|
| demo.5nine.comtest | In scope | 2026-11-14 |
| 5nineservice.demo.5nine.comtest | In scope | 2026-11-14 |
| bg-qa-officeonline.acronis.comtest | In scope | 2026-11-14 |
| bg-vpn-qa.acronis.comtest, vpn | In scope | 2026-11-14 |
| cpas-test.acronis.comtest | In scope | 2026-11-14 |
| csp-demo.acronis.comtest | In scope | 2026-11-14 |
| files.demo.acronis.comdata, test | In scope | 2026-11-14 |
| www.files.demo.acronis.comdata, test | In scope | 2026-11-14 |
| expenses-acm-test.acronis.comtest | In scope | 2026-11-14 |
| notary-test.acronis.comtest | In scope | 2026-11-14 |
| www.notary-test.acronis.comtest | In scope | 2026-11-14 |
| okta-test.acronis.comauth, test | In scope | 2026-11-14 |
| www.okta-test.acronis.comauth, test | In scope | 2026-11-14 |
| uat.partner.acronis.comtest | In scope | 2026-11-14 |
| sandbox-repo.acronis.comgit, test | In scope | 2026-11-14 |
| sit-cloud.acronis.comtest | In scope | 2026-11-14 |
| test.support.acronis.comtest | In scope | 2026-11-14 |
| test-forum.acronis.comtest | In scope | 2026-11-14 |
| test1-rpc.acronis.comapi, test | In scope | 2026-11-14 |
| uat-partner.acronis.comtest | In scope | 2026-11-14 |
| web-api-test.acronis.comapi, test | In scope | 2026-11-14 |
| 004553.werp-okta-test.acep.acronis.workauth, test | In scope | 2026-11-14 |
| test.cbc.acronis.worktest | In scope | 2026-11-14 |
| rndtools-jenkins-test.acronis.workci, test | In scope | 2026-11-14 |
| support-sandbox-esxi.acronis.worktest | In scope | 2026-11-14 |
| ui-perf.acronis.worktest | In scope | 2026-11-14 |
2,283 names are covered by the program's own scope; 1 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.