-CVE-2023-46450

-CVE-2023-46450 Description Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting XSS via the Add supplier function. Additional Information A video POC stored XSS vulnerability exists in the add supplier functionality in free and open source...

CVE-2026-111038

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

CVE-2026-111036

Server-side request forgery SSRF vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the...

CVE-2026-111037

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

EUVD-2026-116822

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

CVE-2026-111038 Multiple vulnerabilities in Coupa’s Total Spend Management Platform

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

CVE-2026-111038

The Coupa Supplier Portal SaaS platform is susceptible to a CSV formula injection vulnerability within its export functionality. The root cause is the lack of proper validation or sanitization of user-controlled data, specifically event names or templates within the Tenders module , before they a...

CVE-2026-111037

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Tenders module of the Coupa Supplier Portal SaaS platform. The root cause is the lack of proper output encoding or sanitization for the list_item_function parameter, which is reflected in the server's response and embedded directl...

EUVD-2026-116821

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111037 Multiple vulnerabilities in Coupa’s Total Spend Management Platform

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111036 Multiple vulnerabilities in Coupa’s Total Spend Management Platform

Server-side request forgery SSRF vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the...

EUVD-2026-116820

Server-side request forgery SSRF vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts Templates’ section. The vulnerability is due to insufficient validation of references to external resources processed by the...

CVE-2026-111036

The Coupa Supplier Portal SaaS platform is affected by a Server-Side Request Forgery (SSRF) vulnerability within the document conversion functionality located in the 'Contracts > Templates' section. The root cause is insufficient validation of references to external resources processed by the ...

EUVD-2026-106726

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft component: Supplier Registration. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-91481

Vulnerability in the PeopleSoft Enterprise SCM Purchasing product of Oracle PeopleSoft component: Supplier Registration. The supported version that is affected is 9.2. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise PeopleSoft Enterprise...

CVE-2026-91481

A vulnerability exists in the Supplier Registration component of Oracle PeopleSoft Enterprise SCM Purchasing (version 9.2 ). A low-privileged attacker with network access via HTTP can exploit this vulnerability to compromise the product, provided they can obtain human interaction from another per...

PT-2026-120003

Name of the Vulnerable Software and Affected Versions Oracle PeopleSoft Enterprise SCM Purchasing version 9.2 Description An issue exists in the Supplier Registration component that allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation...

Oracle PeopleSoft Enterprise SCM Purchasing security vulnerability

Oracle PeopleSoft Enterprise SCM Purchasing version 9.2 contains a security vulnerability stemming from issues in the Supplier Registration component. This vulnerability may allow low-privilege attackers to perform unauthorized updates, inserts, or deletions of certain accessible data via HTTP, a...

CVE-2026-109182

jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass role data scope restrictions enforced by /supplier/list. Attackers restricted to personal or department data can export every supplier, customer and member...

CVE-2026-109182

jshERP versions through 3.6 are affected by an incorrect authorization vulnerability (CWE-863) in the GET /supplier/exportExcel endpoint. While the /supplier/list endpoint correctly enforces role data scope restrictions, this specific export function fails to do so. This allows authenticated user...