EUVD-2024-54678

Malicious code in bioql PyPI...

Dell Client BIOS Improper SMM Communication Buffer Verification (DSA-2024-104)

The Dell BIOS on the remote device is missing a security patch and is, therefore, affected by an Improper SMM communication buffer verification vulnerability. A physical high privileged attacker could potentially exploit this vulnerability leading to arbitrary writes to SMRAM. Note that Nessus ha...

The vulnerability of AMD’s microprogramming software for graphics processors allows attackers to exploit their privileges.

The vulnerability of the SMM microprogramming system software for AMD graphics processors is related to insufficient control over the flow of execution in AmdCpmOemSmm. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of AMD’s microprogramming software for graphics processors allows attackers to exploit their privileges.

The vulnerability of the SMM microprogramming system software for AMD graphics processors is related to insufficient control over the flow of execution in AmdCpmOemSmm. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2024-36354: Improper Prevention of Lock Bit Modification

Improper input validation for DIMM serial presence detect SPD metadata could allow an attacker with physical access, ring0 access on a system with a non-compliant DIMM, or control over the Root of Trust for BIOS update, to bypass SMM isolation potentially resulting in arbitrary code execution at...

CVE-2024-21947: Insufficient Granularity of Access Control

Improper input validation in the system management mode SMM could allow a privileged attacker to overwrite arbitrary memory potentially resulting in arbitrary code execution at the SMM level...

Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize.

...

CVE-2025-55575

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

CVE-2025-55575

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

PT-2025-34673 · Smm Panel · Smm Panel

Name of the Vulnerable Software and Affected Versions: SMM Panel version 3.1 Description: A SQL Injection vulnerability exists in SMM Panel version 3.1. This allows remote attackers to potentially gain sensitive information by sending a crafted HTTP request with the action parameter set to servic...

CVE-2025-55575

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

SmmFollows SMM Panel 安全漏洞

SmmFollows SMM Panel is an online platform from SmmFollows, Inc. A security vulnerability exists in SmmFollows SMM Panel version 3.1, which stems from an SQL injection in the action=servicedetail parameter, which could lead to the disclosure of sensitive information...

CVE-2025-55575: Improper Neutralization of Special Elements used in an SQL Command

SQL Injection vulnerability in SMM Panel 3.1 allowing remote attackers to gain sensitive information via a crafted HTTP request with action=servicedetail...

CVE-2025-52785

Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through = 6.0.31...

CVE-2025-52785: Missing Authorization

Missing Authorization vulnerability in softnwords SMM API smm-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SMM API: from n/a through = 6.0.31...

PT-2025-32958

Name of the Vulnerable Software and Affected Versions: Tcg2Smm affected versions not specified Description: Tcg2Smm contains a flaw that allows writing arbitrary memory inside SMRAM and executing arbitrary code at the SMM level. Recommendations: At the moment, there is no information about a newe...

CVE-2025-4276: Improper Input Validation

UsbCoreDxe has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

CVE-2025-4277: Improper Input Validation

Tcg2Smm has a vulnerability which can be used to write arbitrary memory inside SMRAM and execute arbitrary code at SMM level...

WordPress SMM API plugin <= 6.0.31 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by theviper17 in WordPress Plugin SMM API versions = 6.0.31...

CVE-2025-3770 SMM IDT Privilege Escalation Vulnerability

EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability...