The mod_survey module versions 3.0.16-pre1 and below for Apache are susceptible to a script injection attack.