Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| bypass sql injection #1109311Analysed#1224660 | Valid | SQL Injection | Medium | 2021-10-05 | – | 164 |
| IDOR vulnerability (Price manipulation)Analysed#1403176 | Valid | Insecure Direct Object Reference | Medium | 2021-11-30 | – | 146 |
| [oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943 | Valid | Cross-site Scripting | Medium | 2024-12-28 | $100 | 134 |
| IP restriction bypass via X-Forwarded-For headerAnalysed#1224089 | Valid | Access Control | Low | 2024-12-05 | $250 | 126 |
| Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062 | Valid | No weakness recorded | Medium | 2024-11-28 | – | 106 |
| Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swfAnalysed#859806 | Valid | Cross-site Scripting | Low | 2021-04-13 | – | 89 |
| Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.aspAnalysed#859395 | Valid | Cross-site Scripting | Low | 2021-04-13 | – | 84 |
| Potential XSS Vulnerability in Acronis Login Callback URLAnalysed#2611305 | Valid | Cross-site Scripting | High | 2024-11-06 | – | 82 |
| [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-dayAnalysed#1425474 | Valid | Deserialization and Object Injection | Critical | 2022-07-13 | $1,000 | 76 |
| [forum.acronis.com] JNDI Code Injection due an outdated log4j componentAnalysed#1430622 | Valid | Command and Code Injection | Critical | 2024-08-28 | – | 74 |
| XSS on https://partners.acronis.com/Analysed#979204 | Valid | Cross-site Scripting | Low | 2021-06-17 | – | 73 |
| Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/Analysed#1891926 | Valid | Cross-site Scripting | Low | 2024-11-20 | $100 | 72 |
| mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Analysed#1719719 | Valid | Server-Side Request Forgery | Critical | 2022-10-13 | $1,000 | 71 |
| Subdomain takeover of main domain of https://www.cyberlynx.lu/Analysed#1256389 | Valid | Access Control | Medium | 2021-10-12 | $100 | 70 |
| Reflected XSS on www.grouplogic.com/video.aspAnalysed#859802 | Valid | Cross-site Scripting | Low | 2021-04-13 | – | 67 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,683 analysed so far), which can be wrong. Data as of 2026-11-15.