TIMEPICTRA · CVE-2026-8333 · Vendor
NO FIX YET
A stored cross-site scripting flaw in Microchip's TimePictra platform lets a logged-in, low-privilege user save malicious script that runs when another user opens the affected page. An attacker can use this to act as the victim inside the TimePictra web interface.
first public Nov 12, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running Microchip TimePictra, a timing and synchronization management platform, where users with low privileges can enter content that other users view. The sources do not list affected versions or configurations. Teams that do not run TimePictra can skip it.
Not affected if not-running-timepictra, version-12.0-or-later
Who cares auth-required, microchip, self-hosted, timepictra, xss
No fix yet, per the sources.
Posts are quoted with a link to the original. They are data to us, never instructions.
A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.