Search
Find a vulnerability
Search criteria
8 vulnerabilities by Coupa
CVE-2026-111040 (GCVE-0-2026-111040)
Vulnerability from nvd – Published: 2026-11-04 09:54 – Updated: 2026-11-04 09:54
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
Severity
CWE
- CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:44
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users\u2019 browsers, affecting the display of content within the application."
}
],
"value": "The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users\u2019 browsers, affecting the display of content within the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:54:08.688Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111040",
"datePublished": "2026-11-04T09:54:08.688Z",
"dateReserved": "2026-10-15T12:34:55.138Z",
"dateUpdated": "2026-11-04T09:54:08.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111038 (GCVE-0-2026-111038)
Vulnerability from nvd – Published: 2026-11-04 09:44 – Updated: 2026-11-04 09:44
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.
Severity
CWE
- CWE-1236 - Improper neutralization of formula elements in a CSV file
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:37
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim\u2019s context."
}
],
"value": "CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim\u2019s context."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CWE-1236 Improper neutralization of formula elements in a CSV file",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:44:04.821Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111038",
"datePublished": "2026-11-04T09:44:04.821Z",
"dateReserved": "2026-10-15T12:29:42.969Z",
"dateUpdated": "2026-11-04T09:44:04.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111037 (GCVE-0-2026-111037)
Vulnerability from nvd – Published: 2026-11-04 09:35 – Updated: 2026-11-04 09:35
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface.
Severity
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:31
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server\u2019s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim\u2019s browser. A successful exploit could allow the attacker to perform actions on the victim\u2019s behalf, disclose accessible information or manipulate the user interface."
}
],
"value": "A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server\u2019s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim\u2019s browser. A successful exploit could allow the attacker to perform actions on the victim\u2019s behalf, disclose accessible information or manipulate the user interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:35:57.107Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111037",
"datePublished": "2026-11-04T09:35:57.107Z",
"dateReserved": "2026-10-15T12:29:42.021Z",
"dateUpdated": "2026-11-04T09:35:57.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111036 (GCVE-0-2026-111036)
Vulnerability from nvd – Published: 2026-11-04 09:29 – Updated: 2026-11-04 09:36
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
Severity
CWE
- CWE-918 - Server-Side request forgery (SSRF)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2024
(custom)
cpe:2.3:a:coupa:coupa_s_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:12
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2024",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_s_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2024",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:12:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the \u2018Contracts \u0026gt; Templates\u2019 section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services."
}
],
"value": "Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the \u2018Contracts \u003e Templates\u2019 section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:36:53.318Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111036",
"datePublished": "2026-11-04T09:29:51.856Z",
"dateReserved": "2026-10-15T12:29:40.794Z",
"dateUpdated": "2026-11-04T09:36:53.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111040 (GCVE-0-2026-111040)
Vulnerability from cvelistv5 – Published: 2026-11-04 09:54 – Updated: 2026-11-04 09:54
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.
Severity
CWE
- CWE-80 - Improper neutralization of Script-Related HTML tags in a web page (basic XSS)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:44
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:44:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users\u2019 browsers, affecting the display of content within the application."
}
],
"value": "The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users\u2019 browsers, affecting the display of content within the application."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:54:08.688Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111040",
"datePublished": "2026-11-04T09:54:08.688Z",
"dateReserved": "2026-10-15T12:34:55.138Z",
"dateUpdated": "2026-11-04T09:54:08.688Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111038 (GCVE-0-2026-111038)
Vulnerability from cvelistv5 – Published: 2026-11-04 09:44 – Updated: 2026-11-04 09:44
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim’s context.
Severity
CWE
- CWE-1236 - Improper neutralization of formula elements in a CSV file
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:37
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim\u2019s context."
}
],
"value": "CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in CSV files generated by the application. An attacker with low privileges can input specially crafted values that begin with characters interpreted as formulas by spreadsheet applications. When a victim downloads and opens the generated file in a compatible client, the content may be interpreted as a formula, potentially leading to unauthorised actions such as the execution of commands via mechanisms such as DDE, access to information, or interaction with system resources under the victim\u2019s context."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "ACTIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1236",
"description": "CWE-1236 Improper neutralization of formula elements in a CSV file",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:44:04.821Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111038",
"datePublished": "2026-11-04T09:44:04.821Z",
"dateReserved": "2026-10-15T12:29:42.969Z",
"dateUpdated": "2026-11-04T09:44:04.821Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111037 (GCVE-0-2026-111037)
Vulnerability from cvelistv5 – Published: 2026-11-04 09:35 – Updated: 2026-11-04 09:35
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim’s browser. A successful exploit could allow the attacker to perform actions on the victim’s behalf, disclose accessible information or manipulate the user interface.
Severity
CWE
- CWE-79 - Improper neutralization of input during web page generation ('cross-site scripting')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2026
(custom)
cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:31
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2026",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2026",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:31:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server\u2019s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim\u2019s browser. A successful exploit could allow the attacker to perform actions on the victim\u2019s behalf, disclose accessible information or manipulate the user interface."
}
],
"value": "A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server\u2019s response without proper output encoding or sanitisation, and is directly embedded within the context of a JavaScript event handler. An attacker with a low-privileged account could create a malicious URL containing JavaScript payloads which, when opened by a victim, would execute arbitrary scripts within the context of the victim\u2019s browser. A successful exploit could allow the attacker to perform actions on the victim\u2019s behalf, disclose accessible information or manipulate the user interface."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper neutralization of input during web page generation (\u0027cross-site scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:35:57.107Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111037",
"datePublished": "2026-11-04T09:35:57.107Z",
"dateReserved": "2026-10-15T12:29:42.021Z",
"dateUpdated": "2026-11-04T09:35:57.107Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-111036 (GCVE-0-2026-111036)
Vulnerability from cvelistv5 – Published: 2026-11-04 09:29 – Updated: 2026-11-04 09:36
VLAI
EPSS
VEX
Title
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Summary
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services.
Severity
CWE
- CWE-918 - Server-Side request forgery (SSRF)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Coupa | Coupa Total Spend Management Platform |
Affected:
0 , < 04/11/2024
(custom)
cpe:2.3:a:coupa:coupa_s_total_spend_management_platform:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 09:12
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Coupa Total Spend Management Platform",
"vendor": "Coupa",
"versions": [
{
"lessThan": "04/11/2024",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:coupa:coupa_s_total_spend_management_platform:*:*:*:*:*:*:*:*",
"versionEndExcluding": "04_11_2024",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "David Sacrist\u00e1n Manzanares"
}
],
"datePublic": "2026-11-04T09:12:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the \u2018Contracts \u0026gt; Templates\u2019 section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services."
}
],
"value": "Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the \u2018Contracts \u003e Templates\u2019 section. The vulnerability is due to insufficient validation of references to external resources processed by the Aspose.Words for Java library during DOCX-to-PDF conversion. An authenticated attacker with permissions to modify templates could upload a specially crafted DOCX document containing references to external resources, which would cause the server-side application to access URLs controlled by the attacker, resources on the internal network, or local files. A successful exploit could lead to the disclosure of sensitive information, such as configuration files, system files, credentials, environment variables and endpoints for internal services."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "HIGH",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:H/SI:L/SA:L",
"version": "4.0",
"vulnAvailabilityImpact": "LOW",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "CWE-918 Server-Side request forgery (SSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-04T09:36:53.318Z",
"orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"shortName": "INCIBE"
},
"references": [
{
"url": "https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "No solution has been reported as yet."
}
],
"value": "No solution has been reported as yet."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Multiple vulnerabilities in Coupa\u2019s Total Spend Management Platform",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516",
"assignerShortName": "INCIBE",
"cveId": "CVE-2026-111036",
"datePublished": "2026-11-04T09:29:51.856Z",
"dateReserved": "2026-10-15T12:29:40.794Z",
"dateUpdated": "2026-11-04T09:36:53.318Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}