Browse / Acronis

Acronis

See its reports on the map

Attack surface: 2,283 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Acronis

• Access Control39
• Cross-site Scripting35
• Authentication10
• Information Disclosure7
• Misconfiguration6
• SQL Injection5

Most upvoted reports

AllValidInformativeN/ADuplicate

1. SQL Injection in agent-managerSQL Injection · high
   237 votes
2. bypass sql injection #1109311SQL Injection · medium
   164 votes
3. IDOR vulnerability (Price manipulation)Insecure Direct Object Reference (IDOR) · medium
   146 votes
4. Ticket Trick at https://account.acronis.comImproper Access Control - Generic · high
   142 votes
5. [oem.acronis.com] Reflected Cross Site Scripting Cross-site Scripting (XSS) - Reflected · medium
   $100134 votes
6. IP restriction bypass via X-Forwarded-For headerForced Browsing · low
   $250126 votes
7. Stored XSS in backup scanning plan nameCross-site Scripting (XSS) - Stored · medium
   $500120 votes
8. SQL injection on admin.acronis.host development web serviceSQL Injection · high
   $250118 votes
9. Attacker Can Access to any Ticket Support on https://www.devicelock.com/support/Improper Access Control - Generic · medium
   109 votes
10. Rate limit bypass on passport.acronis.work using X-Forwarded-For request headerImproper Restriction of Authentication Attempts · medium
    106 votes
11. SQL injection in https://www.acronis.cz/ via the log parameterSQL Injection · medium
    103 votes
12. Flash Based Reflected XSS on www.grouplogic.com/jwplayer/player.swfCross-site Scripting (XSS) - Reflected · low
    89 votes
13. Reflected XSS on http://www.grouplogic.com/files/glidownload/verify.aspCross-site Scripting (XSS) - Reflected · low
    84 votes
14. Potential XSS Vulnerability in Acronis Login Callback URLCross-site Scripting (XSS) - Generic · high
    82 votes
15. Delete any user's added Email,Telephone,Fax,Address,Skype via csrf in (https://academy.acronis.com/)Cross-Site Request Forgery (CSRF) · low
    82 votes
16. [CVE-2021-44228] nps.acronis.com is vulnerable to the recent log4shell 0-dayDeserialization of Untrusted Data · critical
    $1,00076 votes
17. [forum.acronis.com] JNDI Code Injection due an outdated log4j componentOS Command Injection · critical
    74 votes
18. XSS on https://partners.acronis.com/Cross-site Scripting (XSS) - DOM · low
    73 votes
19. Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/Cross-site Scripting (XSS) - Reflected · low
    $10072 votes
20. mail.acronis.com is vulnerable to zero day vulnerability CVE-2022-41040Server-Side Request Forgery (SSRF) · critical
    $1,00071 votes
21. Subdomain takeover of main domain of https://www.cyberlynx.lu/Privilege Escalation · medium
    $10070 votes
22. Reflected XSS on www.grouplogic.com/video.aspCross-site Scripting (XSS) - Reflected · low
    67 votes
23. Stored Cross-site Scripting on devicelock.com/forum/Cross-site Scripting (XSS) - Stored · medium
    65 votes
24. Blind XSS on admin.acronis.com via delete account form on account.acronis.comCross-site Scripting (XSS) - Stored · high
    65 votes
25. Potential XSS in redirect_url ParameterCross-site Scripting (XSS) - Reflected · medium
    64 votes
26. Stored XSS in Acronis Cyber Protect ConsoleCross-site Scripting (XSS) - Stored · medium
    $50063 votes
27. IDOR in backup recovery functionalityInsecure Direct Object Reference (IDOR) · high
    56 votes
28. Bypassing Recaptcha Protection in `https://connect.acronis.com`Violation of Secure Design Principles · low
    54 votes
29. Blind SSRF vulnerability on cz.acronis.comServer-Side Request Forgery (SSRF) · medium
    53 votes
30. HTML Injection in E-mailCross-site Scripting (XSS) - Generic · low
    52 votes
31. SQL injection in https://demor.adr.acronis.com/ via the username parameterSQL Injection · high
    49 votes
32. IDOR on www.acronis.com API lead to steal private business user informationInsecure Direct Object Reference (IDOR) · medium
    $10048 votes
33. admin password disclosure via log file Information Disclosure · medium
    $10045 votes
34. Stored XSS in profile pageCross-site Scripting (XSS) - Stored · medium
    $5045 votes
35. Missing rate limit for current password field (Password Change) Account TakeoverImproper Restriction of Authentication Attempts · medium
    44 votes
36. Reflected XSS via "Error" parameter on https://admin.acronis.com/admin/su/Cross-site Scripting (XSS) - Reflected · medium
    $5039 votes
37. Arbitrary file creation via symlink attack on syncagentsrv (Acronis Sync Agent Service)Privilege Escalation · high
    38 votes
38. CSS Injection via Client Side Path Traversal + Open Redirect leads to personal data exfiltration on Acronis CloudCross-site Scripting (XSS) - DOM · medium
    37 votes
39. FULL SSRF Server-Side Request Forgery (SSRF) · low
    37 votes
40. Self XSS on Acronis Cyber CloudCross-site Scripting (XSS) - Generic · low
    $10037 votes
41. %0A (New line) and limitness URL leads to DoS at all system [Main adress (https://www.acronis.com/)]Uncontrolled Resource Consumption · low
    36 votes
42. licenses key disclosureCleartext Storage of Sensitive Information · low
    $5036 votes
43. Possible LDAP username and password disclosed on GithubInformation Disclosure · medium
    36 votes
44. Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.htmlCross-site Scripting (XSS) - Reflected · low
    34 votes
45. Acronis True Image (Windows) does not validate server certificate on a TLS connectionImproper Certificate Validation · high
    $50034 votes
46. [CVE-2021-44228] Arbitrary Code Execution on ng01-cloud.acronis.comCode Injection · critical
    33 votes
47. Blind Stored XSS in https://partners.acronis.com/admin which lead to sensitive information/PII leakageCross-site Scripting (XSS) - Stored · high
    $15033 votes
48. [acronis.secure.force.com] - Insecure Salesforce default/custom object permissions leads to information disclosureInformation Disclosure · low
    31 votes
49. Local Privilege Escalation and Code Execution when restoring files from QuarantinePrivilege Escalation · medium
    $25030 votes
50. XSS in (Support Requests) : User CasesCross-site Scripting (XSS) - Stored · medium
    $5030 votes
51. Read-only administrator can change agent update settingsImproper Access Control - Generic · medium
    $20029 votes
52. Web cache poisoning at www.acronis.comViolation of Secure Design Principles · medium
    29 votes
53. XSS Stored in Cacheable responseCross-site Scripting (XSS) - Stored · medium
    28 votes
54. mysql credentials exposed on - https://cz.acronis.com/docker-compose.ymlInsufficiently Protected Credentials · low
    28 votes
55. Cross Site Scripting (Reflected) on https://www.acronis.cz/Cross-site Scripting (XSS) - Reflected · low
    $5027 votes
56. Credentials leaked via GithubUse of Hard-coded Credentials · medium
    $5026 votes
57. Local Privilege Escalation via DLL Search-Order Hijacking with Cyber Protection Agent - systeminfo.exe utilityPrivilege Escalation · medium
    26 votes
58. Cross Origin Resource Sharing MisconfigurationImproper Access Control - Generic · medium
    26 votes
59. Administrative access to development deployment of web service due to auto-filled credentialsImproper Authentication - Generic · high
    $25026 votes
60. HTML Injection in E-mail Not Resolved ()Cross-site Scripting (XSS) - Generic · medium
    25 votes
61. Local Privilege Escalation when updating Acronis True ImagePrivilege Escalation · medium
    $25025 votes
62. Local privilege escalation via insecure MSI filePrivilege Escalation · high
    $25025 votes
63. XSS in https://promo.acronis.com/Cross-site Scripting (XSS) - DOM · low
    25 votes
64. CSRF and XSS on www.acronis.comCross-site Scripting (XSS) - Reflected · low
    25 votes
65. Reflected XSS on my.acronis.comCross-site Scripting (XSS) - Generic · low
    $5024 votes
66. Cross Site Scripting (Reflected) on https://www.acronis.cz/dotaznik/roadshow-2020/Cross-site Scripting (XSS) - Reflected · low
    $5023 votes
67. Local Privilege Escalation via Backup deletePrivilege Escalation · medium
    $25021 votes
68. Local File Disclosure /Delete On [us-az-vpn.acronis.com]Path Traversal · medium
    21 votes
69. Account Takeover on unverified emails in File Sync & Share Violation of Secure Design Principles · medium
    21 votes
70. unauth mosquitto ( client emails, ips, license keys exposure )Improper Access Control - Generic · medium
    $15020 votes
71. Self XSS in attachments nameCross-site Scripting (XSS) - Generic · low
    20 votes
72. Cross-site Scripting (XSS) - Stored | forum.acronis.comCross-site Scripting (XSS) - Stored · medium
    20 votes
73. Any expired reset password link can still be used to reset the passwordImproper Access Control - Generic · low
    $10019 votes
74. CVE-2021-40438 on cp-eu2.acronis.comServer-Side Request Forgery (SSRF) · high
    19 votes
75. Clickjacking on cas.acronis.com login pageUI Redressing (Clickjacking) · low
    19 votes
76. DOM based XSS in store.acronis.com/<id>/purl-corporate-standard-IT [cfg parameter]Cross-site Scripting (XSS) - DOM · low
    $5019 votes
77. Subdomain Takeover – www.jet.acronis.com pointing to unclaimed Webflow servicesPrivilege Escalation · low
    19 votes
78. Broken Access ControlsImproper Access Control - Generic
    19 votes
79. Acronis True Image 2021 (windows) does not validate server hostname on a login TLS connectionImproper Certificate Validation · high
    $25018 votes
80. Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation)Privilege Escalation · low
    17 votes
81. anti_ransomware_service.exe REST API does not require authenticationMissing Authentication for Critical Function · medium
    17 votes
82. Missing brute force protection on login page on www.acronis.comImproper Restriction of Authentication Attempts
    $25016 votes
83. HTTP Request Smuggling on https://consumer.acronis.comHTTP Request Smuggling · low
    16 votes
84. Store Admin Page Accessible Without Authentication at http://www.grouplogic.com/ADMIN/store/index.cfmImproper Access Control - Generic · medium
    $25015 votes
85. Stored Cross Site Scripting at http://www.grouplogic.com/ADMIN/store/index.cfm?fa=disprocodeCross-site Scripting (XSS) - Stored · medium
    15 votes
86. DLL Hijacking when sending feedback and crash report leading to Privilege EscalationPrivilege Escalation · medium
    $25015 votes
87. Large Amounts of Back-End Acronis Source Code is Publicly AccessibleInformation Exposure Through Directory Listing · medium
    $25015 votes
88. Arbitrary Files and Folders Deletion vulnerability with Acronis Managed Machine ServicePrivilege Escalation · medium
    15 votes
89. Subdomain Takeover – jet.acronis.com pointing to unclaimed Webflow servicesPrivilege Escalation · low
    15 votes
90. Acronis True Image Local Privilege Escalation via insecure folder permissionsPrivilege Escalation · medium
    $30015 votes
91. TrueImage for Acronis True Image 2020 - Untrusted DLL Search-Ordering lead to Privilege Escalation as Administrative accountPrivilege Escalation · medium
    $25014 votes
92. DLL Hijacking when creating Rescue Media Builder leading to Privilege EscalationPrivilege Escalation · medium
    $25013 votes
93. HTTP Request Smuggling on https://promosandbox.acronis.comHTTP Request Smuggling · low
    12 votes
94. Open redirect at mc-beta-cloud-acronis.comOpen Redirect
    12 votes
95. Local Privilege Escalation when deleting a file from QuarantinePrivilege Escalation · medium
    $25011 votes
96. No brute force protection on web-api-cloud.acronis.comImproper Restriction of Authentication Attempts · low
    $10011 votes
97. Arbitrary DLL injection in mmsminisrv (Acronis Managed Machine Service Mini)Privilege Escalation · high
    11 votes
98. Acronis Sync Agent Service - Untrusted DLL Search-Ordering lead to Privilege EscalationPrivilege Escalation · medium
    $25011 votes
99. DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege EscalationPrivilege Escalation · medium
    $2509 votes
100. Reflected XSS on cz.acronis.com/dekujeme-za-odber-novinek-produktu-disk-director with ability to creating an admin user in WordPressCross-site Scripting (XSS) - Reflected · medium
     9 votes