CVE-2021-41609

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

SQL injection in the ID parameter of the UploadedImageDisplay.aspx endpoint of SelectSurvey.NET before 5.052.000 allows a remote, unauthenticated attacker to retrieve data from the application's backend database via boolean-based blind and UNION injection.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Jan 28, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-41617.5The affected products contain vulnerable firmware, which could allow an attacker to sniff the traffic and decrypt login credential details. CVE-2021-416117.5An issue was discovered in Squid 5.0.6 through 5.1.x before 5.2. When validating an origin server or peer certificate, Squid may incorrectlyCVE-2021-416128.8An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not being updated correctly for the subtract insCVE-2021-416134.3An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic of Exception Effective Address Register (EECVE-2021-416147.8An issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write access permissions to the Exception Program CVE-2021-416159.8websda.c in GoAhead WebServer 2.1.8 has insufficient nonce entropy because the nonce calculation relies on the hardcoded onceuponatimeinparaCVE-2021-416169.8Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY,CVE-2021-416177.0sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplementCVE-2021-416197.2An issue was discovered in Gradle Enterprise before 2021.1.2. There is potential remote code execution via the application startup configuraCVE-2021-41624.3archivy is vulnerable to Cross-Site Request Forgery (CSRF)CVE-2021-416345.3A user enumeration vulnerability in MELAG FTP Server 2.2.0.4 allows an attacker to identify valid FTP usernames.CVE-2021-416358.8When installed as Windows service MELAG FTP Server 2.2.0.4 is run as SYSTEM user, which grants remote attackers to abuse misconfigurations o