{"id":"CVE-2026-8333","kind":"vulnerability","aliases":["CVE-2026-8333"],"related":[],"title":"Microchip TimePictra: stored script lets low-privilege users attack other users","description":"A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page","summary":"A stored cross-site scripting flaw in Microchip's TimePictra platform lets a logged-in, low-privilege user save malicious script that runs when another user opens the affected page. An attacker can use this to act as the victim inside the TimePictra web interface.","severity":"critical","cvss":9.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"TimePictra","fixed":[],"affected":"< 12.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["auth-required","microchip","self-hosted","timepictra","vendor","xss"],"not_affected_if":["not-running-timepictra","version-12.0-or-later"],"how_to_check":"Check your TimePictra version in the web UI; versions before 12.0 are listed as affected in the CVE record. Also review which low-privilege accounts exist, since exploitation needs a logged-in user.","fix":null,"status":"open","published_at":"2026-11-12T07:16:49+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","triaged_at":"2026-11-12T07:38:04+00:00","updated_at":"2026-11-12T07:39:44+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T07:38:04Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microchip TimePictra: stored script lets low-privilege users attack other users","impact":"medium","summary":"A stored cross-site scripting flaw in Microchip's TimePictra platform lets a logged-in, low-privilege user save malicious script that runs when another user opens the affected page. An attacker can use this to act as the victim inside the TimePictra web interface.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["timepictra","microchip","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker runs script in another user's session and takes actions as them","analyst_note":"Find affected TimePictra versions and Microchip's advisory or patch from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8333 or Microchip's security page.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-running-timepictra"],"who_is_affected":"Organizations running Microchip TimePictra, a timing and synchronization management platform, where users with low privileges can enter content that other users view. The sources do not list affected versions or configurations. Teams that do not run TimePictra can skip it.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000696,"input_tokens":4517,"output_tokens":488,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find affected TimePictra versions and Microchip's advisory or patch from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-8333 or Microchip's security page.","search":"'-2026':14A,17A '-8333':15A,18A 'act':69B 'affect':61B,110C 'allow':91C 'anoth':57B,106C 'attack':10A,64B,97C 'auth':21B 'auth-requir':20B 'authent':93C 'content':102C 'could':90C 'cross':33B,81C 'cross-sit':32B,80C 'cve':13A,16A 'execut':104C 'flaw':36B 'host':26B 'insid':73B 'interfac':77B 'let':5A,42B 'log':45B 'logged-in':44B 'low':7A,48B,95C 'low-privileg':6A,47B,94C 'malici':52B,100C 'microchip':1A,23B,38B,86C 'open':59B 'page':62B,111C 'platform':41B,89C 'privileg':8A,49B,96C 'requir':22B 'run':55B 'save':51B 'script':4A,35B,53B,83C,101C 'self':25B 'self-host':24B 'site':34B,82C 'store':3A,31B,79C,99C 'timepictra':2A,19A,27B,40B,75B,88C 'use':66B 'user':9A,12A,50B,58B,107C 'vendor':28B 'victim':72B 'view':108C 'vulner':84C 'web':76B 'xss':29B","nicknames":[],"mitigations":[],"who_affected":"Organizations running Microchip TimePictra, a timing and synchronization management platform, where users with low privileges can enter content that other users view. The sources do not list affected versions or configurations. Teams that do not run TimePictra can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["timepictra"],"ptokens":["timepictra"],"labels":["authrequired","critical","microchip","selfhosted","timepictra","vendor","xss"],"campaign_type":null,"search_a":"'-2026':14A,17A '-8333':15A,18A 'attack':10A 'cve':13A,16A 'let':5A 'low':7A 'low-privileg':6A 'microchip':1A 'privileg':8A 'script':4A 'store':3A 'timepictra':2A,19A 'user':9A,12A","search_b":"'act':69B 'affect':61B 'anoth':57B 'attack':64B 'auth':21B 'auth-requir':20B 'cross':33B 'cross-sit':32B 'flaw':36B 'host':26B 'insid':73B 'interfac':77B 'let':42B 'log':45B 'logged-in':44B 'low':48B 'low-privileg':47B 'malici':52B 'microchip':23B,38B 'open':59B 'page':62B 'platform':41B 'privileg':49B 'requir':22B 'run':55B 'save':51B 'script':35B,53B 'self':25B 'self-host':24B 'site':34B 'store':31B 'timepictra':27B,40B,75B 'use':66B 'user':50B,58B 'vendor':28B 'victim':72B 'web':76B 'xss':29B","search_c":"'affect':110C 'allow':91C 'anoth':106C 'attack':97C 'authent':93C 'content':102C 'could':90C 'cross':81C 'cross-sit':80C 'execut':104C 'low':95C 'low-privileg':94C 'malici':100C 'microchip':86C 'page':111C 'platform':89C 'privileg':96C 'script':83C,101C 'site':82C 'store':79C,99C 'timepictra':88C 'user':107C 'view':108C 'vulner':84C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T07:16:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-8333","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8333","severity":null,"published_at":"2026-11-12T07:16:49+00:00","modified_at":"2026-11-12T07:16:49+00:00","first_seen_at":"2026-11-12T07:37:04+00:00","fetched_at":"2026-11-12T07:37:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-8333:3714","url":"https://vulnerability.circl.lu/vuln/cve-2026-8333","severity":null,"published_at":"2026-11-12T07:39:44+00:00","modified_at":"2026-11-12T07:39:44+00:00","first_seen_at":"2026-11-12T07:39:44+00:00","fetched_at":"2026-11-12T07:39:44+00:00","note":"CVE record (Microchip CNA, via circl) lists TimePictra < 12.0 affected; credit TIM Security Red Team. Microchip's own advisory page for this CVE not found/readable (only the Feb PSIRT-124 pages for CVE-2026-3010/2844, a different flaw). Nothing verified; fix not stated by vendor. Sibling CVEs 8331 (file upload RCE) and 8332 same day, same range. No exploitation or PoC found.","cites":["https://vulnerability.circl.lu/vuln/cve-2026-8333","https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting"]}],"documents":[{"id":132941,"url":"https://vulnerability.circl.lu/vuln/cve-2026-8333","title":"CVE-2026-8333 CVE record (Microchip CNA) via Vulnerability-Lookup","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":132942,"url":"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting","title":"Microchip PSIRT-124 TimePictra Stored XSS (CVE-2026-3010, earlier, different flaw)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}