Cross-Site Scripting Vulnerability in Bitdefender SecurePass by Psono

CVE-2025-1987

What is CVE-2025-1987?

A Cross-Site Scripting (XSS) vulnerability has been discovered in the Psono-Client's management of vault entries, specifically those categorized as website_password and bookmark. The vulnerability arises from inadequate sanitization of the URL field within these entries, enabling an attacker to create a malicious vault entry or deceive a user into importing one containing a harmful javascript:URL. If the user then interacts with this malicious entry, such as by clicking on it, the application may execute the nefarious JavaScript code within the context of the Psono vault, potentially exposing the user to risks such as unauthorized access to their password vault and other sensitive information.

References