Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| SQL Injection in agent-managerAnalysed#962889 | Valid | SQL Injection | High | 2021-08-16 | – | 237 |
| bypass sql injection #1109311Analysed#1224660 | Valid | SQL Injection | Medium | 2021-10-05 | – | 164 |
| IDOR vulnerability (Price manipulation)Analysed#1403176 | Valid | Insecure Direct Object Reference | Medium | 2021-11-30 | – | 146 |
| Ticket Trick at https://account.acronis.comAnalysed#999765 | Valid | Access Control | High | 2020-11-10 | – | 142 |
| [oem.acronis.com] Reflected Cross Site ScriptingAnalysed#2038943 | Valid | Cross-site Scripting | Medium | 2024-12-28 | $100 | 134 |
| IP restriction bypass via X-Forwarded-For headerAnalysed#1224089 | Valid | Access Control | Low | 2024-12-05 | $250 | 126 |
| Stored XSS in backup scanning plan nameAnalysed#961046 | Valid | Cross-site Scripting | Medium | 2021-06-28 | $500 | 120 |
| SQL injection on admin.acronis.host development web serviceAnalysed#923020 | Valid | SQL Injection | High | 2021-06-22 | $250 | 118 |
| Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Analysed#1124974 | Valid | Access Control | Medium | 2022-02-08 | – | 109 |
| Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerAnalysed#2627062 | Valid | No weakness recorded | Medium | 2024-11-28 | – | 106 |
| SQL injection in https://www.acronis.cz/ via the log parameterAnalysed#1109311 | Valid | SQL Injection | Medium | 2021-06-11 | – | 103 |
| Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swfAnalysed#859806 | Valid | Cross-site Scripting | Low | 2021-04-13 | – | 89 |
| Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.aspAnalysed#859395 | Valid | Cross-site Scripting | Low | 2021-04-13 | – | 84 |
| Potential XSS Vulnerability in Acronis Login Callback URLAnalysed#2611305 | Valid | Cross-site Scripting | High | 2024-11-06 | – | 82 |
| Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)Analysed#709537 | Valid | No weakness recorded | Low | 2023-04-25 | – | 82 |
| [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-dayAnalysed#1425474 | Valid | Deserialization and Object Injection | Critical | 2022-07-13 | $1,000 | 76 |
| [forum.acronis.com] JNDI Code Injection due an outdated log4j componentAnalysed#1430622 | Valid | Command and Code Injection | Critical | 2024-08-28 | – | 74 |
| XSS on https://partners.acronis.com/Analysed#979204 | Valid | Cross-site Scripting | Low | 2021-06-17 | – | 73 |
| Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/Analysed#1891926 | Valid | Cross-site Scripting | Low | 2024-11-20 | $100 | 72 |
| mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Analysed#1719719 | Valid | Server-Side Request Forgery | Critical | 2022-10-13 | $1,000 | 71 |
| Subdomain takeover of main domain of https://www.cyberlynx.lu/Analysed#1256389 | Valid | Access Control | Medium | 2021-10-12 | $100 | 70 |
| Reflected XSS on www.grouplogic.com/video.aspAnalysed#859802 | Valid | Cross-site Scripting | Low | 2021-04-13 | – | 67 |
| Stored Cross-site Scripting on devicelock.com/forum/Analysed#1122513 | Valid | Cross-site Scripting | Medium | 2022-02-08 | – | 65 |
| Blind XSS on admin.acronis.com via delete account form on account.acronis.comAnalysed#666040 | Valid | Cross-site Scripting | High | 2024-10-30 | – | 65 |
| Potential XSS in redirect_url ParameterAnalysed#2653342 | Valid | Cross-site Scripting | Medium | 2024-11-06 | – | 64 |
| Stored XSS in Acronis Cyber Protect ConsoleAnalysed#1064095 | Valid | Cross-site Scripting | Medium | 2021-06-10 | $500 | 63 |
| IDOR in backup recovery functionalityAnalysed#1901713 | Valid | No weakness recorded | High | 2024-11-13 | – | 56 |
| Bypassing Recaptcha Protection in `https://connect.acronis.com`Analysed#1655629 | Valid | Misconfiguration and Insecure Design | Low | 2024-10-30 | – | 54 |
| Blind SSRF vulnerability on cz.acronis.comAnalysed#1086206 | Valid | Server-Side Request Forgery | Medium | 2024-08-27 | – | 53 |
| HTML Injection in E-mailAnalysed#1536899 | Valid | No weakness recorded | Low | 2022-06-14 | – | 52 |
| SQL injection in https://demor.adr.acronis.com/ via the username parameterAnalysed#1436751 | Valid | SQL Injection | High | 2024-08-28 | – | 49 |
| IDOR on www.acronis.com API lead to steal private business user informationAnalysed#1182465 | Valid | Insecure Direct Object Reference | Medium | 2021-08-31 | $100 | 48 |
| admin password disclosure via log fileAnalysed#1121972 | Valid | Information Disclosure | Medium | 2021-12-21 | $100 | 45 |
| Stored XSS in profile pageAnalysed#1084183 | Valid | Cross-site Scripting | Medium | 2021-11-14 | $50 | 45 |
| Missing rate limit for current password field (Password Change) Account TakeoverAnalysed#827484 | Valid | Authentication | Medium | 2020-10-06 | – | 44 |
| Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/Analysed#970878 | Valid | Cross-site Scripting | Medium | 2021-07-19 | $50 | 39 |
| Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)Analysed#945122 | Valid | Access Control | High | 2021-03-16 | – | 38 |
| CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis CloudAnalysed#1245165 | Valid | Cross-site Scripting | Medium | 2022-11-04 | – | 37 |
| FULL SSRFAnalysed#1241149 | Valid | Server-Side Request Forgery | Low | 2022-02-22 | – | 37 |
| Self XSS on Acronis Cyber CloudAnalysed#957229 | Valid | Cross-site Scripting | Low | 2021-06-28 | $100 | 37 |
| %0A (New line) and limitness URL leads to DoS at all system [Main adress (https://www.acronis.com/)]Analysed#1382448 | Valid | Denial of Service | Low | 2022-01-04 | – | 36 |
| licenses key disclosureAnalysed#1079630 | Valid | Cryptography | Low | 2021-02-09 | $50 | 36 |
| Possible LDAP username and password disclosed on GithubAnalysed#1004412 | Valid | Information Disclosure | Medium | 2021-08-17 | – | 36 |
| Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.htmlAnalysed#1145712 | Valid | Cross-site Scripting | Low | 2024-08-27 | – | 34 |
| Acronis True Image (Windows) does not validate server certificate on a TLS connectionAnalysed#1056144 | Valid | Cryptography | High | 2021-08-05 | $500 | 34 |
| [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.comAnalysed#1459714 | Valid | No weakness recorded | Critical | 2024-08-28 | – | 33 |
| Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakageAnalysed#1028820 | Valid | Cross-site Scripting | High | 2021-07-29 | $150 | 33 |
| [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosureAnalysed#1023572 | Valid | Information Disclosure | Low | 2021-08-17 | – | 31 |
| Local Privilege Escalation and Code Execution when restoring files from QuarantineAnalysed#980500 | Valid | Access Control | Medium | 2024-08-27 | $250 | 30 |
| XSS in (Support Requests) : User CasesAnalysed#961226 | Valid | Cross-site Scripting | Medium | 2021-06-24 | $50 | 30 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,437 analysed so far), which can be wrong. Data as of 2026-11-15.