HTTP Parameter Pollution is only a problem if one of two things are true: 1. Those parameters are used to control something important and by polluting the parameter you can cause some inappropriate behavior (doesn't apply). 2. It's a problem to have user-controlled content inside the html of the page. This is an issue that is more visible via things like Drupal's urls that return 200 responses for a url that is "embarrassing" like https://drupal.org/node/1/acunetix-scans-are-not-super-valid I wold say the fact that the "vulnerability" only shows up on Acunetix sites is evidence is not a "real thing" in the security world.