---
id: "CVE-2026-8333"
page: "https://infrastack.ai/live/CVE-2026-8333"
kind: "vulnerability"
aliases: ["CVE-2026-8333"]
title: "Microchip TimePictra: stored script lets low-privilege users attack other users"
severity: "critical"
cvss: 9.4
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "TimePictra", "fixed": [], "affected": "< 12.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["auth-required", "microchip", "self-hosted", "timepictra", "vendor", "xss"]
not_affected_if: ["not-running-timepictra", "version-12.0-or-later"]
published_at: "2026-11-12T07:16:49+00:00"
first_seen_at: "2026-11-12T07:37:04+00:00"
updated_at: "2026-11-12T07:39:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8333", "first_seen_at": "2026-11-12T07:37:04+00:00"}, {"source": "analyst", "url": "https://vulnerability.circl.lu/vuln/cve-2026-8333", "first_seen_at": "2026-11-12T07:39:44+00:00", "cites": ["https://vulnerability.circl.lu/vuln/cve-2026-8333", "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting"]}]
exploit_sources: []
---

# Microchip TimePictra: stored script lets low-privilege users attack other users

Link for people: https://infrastack.ai/live/CVE-2026-8333 (this .md is for agents)

A stored cross-site scripting flaw in Microchip's TimePictra platform lets a logged-in, low-privilege user save malicious script that runs when another user opens the affected page. An attacker can use this to act as the victim inside the TimePictra web interface.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:TimePictra affected < 12.0 fixed no fixed version listed

## How to check

Check your TimePictra version in the web UI; versions before 12.0 are listed as affected in the CVE record. Also review which low-privilege accounts exist, since exploitation needs a logged-in user.

## Timeline

- 2026-11-12T07:37:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-8333
- 2026-11-12T07:39:44+00:00 analyst https://vulnerability.circl.lu/vuln/cve-2026-8333 — CVE record (Microchip CNA, via circl) lists TimePictra < 12.0 affected; credit TIM Security Red Team. Microchip's own advisory page for this CVE not found/readable (only the Feb PSIRT-124 pages for CVE-2026-3010/2844, a different flaw). Nothing verified; fix not stated by vendor. Sibling CVEs 8331 (file upload RCE) and 8332 same day, same range. No exploitation or PoC found.

## Documents

- [describes] CVE-2026-8333 CVE record (Microchip CNA) via Vulnerability-Lookup https://vulnerability.circl.lu/vuln/cve-2026-8333
- [mentions] Microchip PSIRT-124 TimePictra Stored XSS (CVE-2026-3010, earlier, different flaw) https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting

## From the sources

A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated, low-privileged attacker to store malicious script content that executes when another user views the affected page

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_