Vulnerability · Published Jun 1, 2026 · Assigned by ENISA
CVE-2026-25600Credential Exposure Vulnerability in Trac PDBM
Medium 6.4
In plain English
A medium-severity hard-coded credentials in PDBM from Trac d.o.o.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 0% of all known vulnerabilities).
Official description
The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s configuration file. Because the secret is constant across installations, any attacker with sufficient local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored password and authenticate as the user defined in the configuration file. In the affected version, this user account is configured with administrative privileges, granting full access to PDBM’s management interface and its underlying operational functions.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trac d.o.o. | PDBM | 0 – before 2.0.0.0 |
Weakness: CWE-798 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cert.si/en/cve-2026-25600/ third-party-advisory