CVE-2021-27852: Checkbox Survey Deserialization of Untrusted Data Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-11. EPSS: 30.3% chance of exploitation in the next 30 days.

Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary code. This issue affects: Checkbox Survey versions prior to 7.

Affected products

• Checkbox Survey: before 7.0 (fixed in 7.0)

Published 2021-05-27. Last modified 2026-06-17.