CVE-2025-1987

FAUCET Score

CVE-2025-1987 is a Cross-Site Scripting (XSS) vulnerability affecting Psono-Client, as used in Bitdefender SecurePass and Esaqa SecurePass, specifically in its handling of website_password and bookmark vault entries. The vulnerability arises from improper sanitization of the URL field, allowing an attacker to inject malicious JavaScript via a crafted javascript:URL. This medium-severity vulnerability (CVSS 6.1) requires user interaction (e.g., clicking the malicious entry) to execute arbitrary code in the victim's browser, potentially leading to unauthorized access to their password vault and sensitive data. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		<= 4.0.4CPE matchmatch criteria	cpe:2.3:a:esaqa:psono_client:::::-:-::
		< 0.0.76CPE matchmatch criteria	cpe:2.3:a:bitdefender:securepass:::::web_client:-::
		< 1.0.10CPE matchmatch criteria	cpe:2.3:a:bitdefender:securepass:::::safari:-::
		< 1.1.8CPE matchmatch criteria	cpe:2.3:a:bitdefender:securepass:::::chrome:-::
		< 1.1.18CPE matchmatch criteria	cpe:2.3:a:bitdefender:securepass:::::edge:-::

CVSS Data

CVSS version used by this source: 4.0

9.3CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

PASSIVE

VS Confidentiality

HIGH