CVE-2026-118057

Name of the Vulnerable Software and Affected Versions Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning versions prior to 22.3.3

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. The issue occurs because the hidden path column in ForTraffic.php lacks a client-side render function, leading DataTables to build the cell using innerHTML. This causes stored HTML within the path value to be parsed into live DOM nodes. The vulnerability is triggered via the REQUEST URI parameter, enabling the injection of arbitrary web scripts that execute when a user accesses an affected page.

Recommendations Update Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning to version 22.3.3 or later.