PT-2025-26523 · Unknown · Psono-Client

Published 2025-06-21 · Updated 2025-06-23 · CVE-2025-1987

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions: Psono-Client (affected versions not specified)

Description: A Cross-Site Scripting (XSS) issue has been identified in Psono-Client's handling of vault entries of type website password and bookmark, as used in Bitdefender SecurePass. The client does not properly sanitize the URL field in these entries, allowing an attacker to craft a malicious vault entry with a javascript:URL. When the user interacts with this entry, the application will execute the malicious JavaScript in the context of the Psono vault, potentially giving the attacker access to the user's password vault and sensitive data.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-1987

Affected Products

Psono-Client

References · 9

• https://osv.dev/vulnerability/CVE-2025-1987 · Vendor Advisory
• https://bitdefender.com/support/support/security-advisories/stored-xss-in-psono-client-via-malicious-vault-entry-urls · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1987 · Security Note
• https://twitter.com/VulmonFeeds/status/1936558957344006391 · Twitter Post
• https://t.me/cvetracker/26762 · Telegram Post
• https://twitter.com/CVEnew/status/1936553459874189575 · Twitter Post
• https://twitter.com/CveFindCom/status/1936547207974359045 · Twitter Post
• https://twitter.com/autumn_good_35/status/1937125181786644724 · Twitter Post
• https://t.me/cvenotify/126342 · Telegram Post