The PDBM application contains a static, hard‑coded secret used for decrypting the credentials stored in its configuration file. An attacker who achieves local privileges can extract this secret from the executable, then use it to decrypt the stored password and authenticate as the configured user. Because in the affected version that user has administrative privileges, the attacker gains full control of the PDBM management interface and underlying operational functions.

Vendor Trac d.o.o. product PDBM. No specific version information is provided; attacks affect installations that use the current version containing the hard‑coded secret.

The CVSS score of 6.4 indicates a moderate severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV, suggesting it has not yet been widely exploited. Exploitation requires local privilege to read the binary and configuration file; the attacker then can decrypt credentials and obtain administrative access. Because the vulnerability is only exploitable from the local system, the risk is confined to users who can gain local execution on the host.