CVE-2026-111040

The Coupa Total Spend Management Platform is vulnerable to persistent HTML injection in editable fields managed by TinyMCE . An authenticated attacker with low privileges can inject unsanitized HTML content, which is stored in the database and rendered in other users' browsers. This flaw affects ...