Acronis · Report #1891926
Reflected XSS in https://www.acronis.com/products/cyber-protect/trial/
Validstatus
lowseverity
$100bounty
72upvotes
20 Nov 2024disclosed
How it was found
Enter: https://www.acronis.com/products/cyber-protect/trial/?SFDCCampaignID=zz`;(alert)();//
- will only work outside of USA (I've tried several countries with VPN)
Impact
Leaking users data and and modify the webpage.