CVE-2026-55105 Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, packages/renderer/MdToHtml/rules/fountain.ts passes HTML generated by the vendored fountain.js renderer into note output without sanitizing it. A malicious Fountain...

EUVD-2017-18530

Malware in sbrugna...

EUVD-2021-21303

Malware in sbrugna...

MAL-2025-20819 Malicious code in fountain_4yxmh_8jh5i_lily (npm)

The package fountain4yxmh8jh5ilily was found to contain malicious code...

MAL-2025-20820 Malicious code in fountain_hv8dt_s7anh_undertow (npm)

The package fountainhv8dts7anhundertow was found to contain malicious code...

MAL-2025-40874 Malicious code in zenith_b19cx_fhua2_fountain (npm)

The package zenithb19cxfhua2fountain was found to contain malicious code...

CVE-2021-34653

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

CVE-2021-34653

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

Cross site scripting

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

CVE-2021-34653 WP Fountain <= 1.5.9 Reflected Cross-Site Scripting

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

CVE-2021-34653

The CVE-2021-34653 entry pertains to the WordPress plugin WP Fountain, with vulnerability in versions up to and including 1.5.9. It is a Reflected Cross-Site Scripting (XSS) flaw caused by using $_SERVER['PHP_SELF'] in wp-fountain.php, enabling injection of arbitrary scripts. The connected source...

WordPress plugin WP Fountain 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

PT-2021-20621

Name of the Vulnerable Software and Affected Versions: WP Fountain WordPress plugin versions up to and including 1.5.9 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to the use of $ SERVER'PHP SELF' in the /wp-fountain.php file. This allows attackers to inje...

CVE-2021-34653: Improper Neutralization of Input During Web Page Generation

The WP Fountain WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.5.9...

WordPress WP Fountain plugin <= 1.5.9 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by p7e4 in WordPress WP Fountain plugin versions = 1.5.9. Solution This plugin has been closed as of August 12, 2021 and is not available for download. This closure is temporary, pending a full review...

WP Fountain <= 1.5.9 - Reflected Cross-Site Scripting

The plugin is vulnerable to Reflected Cross-Site Scripting due to the use of $SERVER'PHPSELF' in the /wp-fountain.php file which allows attackers to inject arbitrary web scripts...

fountain-of-life.org Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-968880 Security Researcher Gh05tPT Helped patch 6884 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting fountain-of-life.org...

drinkingfountaindoctor.com XSS vulnerability

Open Bug Bounty ID: OBB-452005 Description| Value ---|--- Affected Website:| drinkingfountaindoctor.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2017-9599

The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...

Information disclosure

The "Fountain Trust Mobile Banking" by FOUNTAIN TRUST COMPANY app before 3.2.0 -- aka fountain-trust-mobile-banking/id891343006 for iOS does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted...