CVE-2026-25600
Credential Exposure Vulnerability in Trac PDBM
- Published
- Updated
- Reserved
- Assigned by
- ENISA
Description
The PDBM application relies on a static, hard‑coded secret embedded in the PDBM.exe executable. This secret is used by the application’s encryption routines, including the function responsible for decrypting credentials stored in the product’s configuration file. Because the secret is constant across installations, any attacker with sufficient local privileges can extract it from the binary. Once obtained, the secret allows the attacker to decrypt the stored password and authenticate as the user defined in the configuration file. In the affected version, this user account is configured with administrative privileges, granting full access to PDBM’s management interface and its underlying operational functions.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| ENISACNA (assigner) | 3.1 | Medium6.4 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Awaiting Analysis | 3.1 | Medium6.4 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.07% · top 100% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.4.
Weakness
Affected products
- affected < 2.0.0.0
References (1)
- https://www.cert.si/en/cve-2026-25600/ (opens in a new tab)third-party-advisory
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-25600)Record last updated .