CVE-2026-3010

The vulnerability consists of improper filtering and encoding of input data before embedding it in generated HTML pages of the TimePictra application. An attacker can inject malicious script code (e.g., JavaScript) that will be executed in the victim's browser. The attack does not require authentication or user interaction on the attacker's side, and the vector is the network (AV:N), which means it can be carried out remotely. The vulnerability type indicates the possibility of querying the system for information using specially crafted queries.

An attacker can gain access to sensitive information in the context of the victim's browser (e.g., session cookies, authentication tokens) and perform unauthorized operations on behalf of the logged-in user, as well as potentially read or modify data presented by the application.

Apply patches available from the manufacturer in accordance with the references. Information about updates is available at: https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/timepictra-stored-cross-site-scripting

Microchip TimePictra versions 11.0 to 11.3 SP2 (inclusive).