EUVD-2026-116822

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

EUVD-2026-116821

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111038

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

CVE-2026-111037

A reflected Cross-Site Scripting XSS vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the listitemfunction parameter is reflected in the server’s response without proper output encoding or sanitisation, and is directly embedded withi...

CVE-2026-111038

The Coupa Supplier Portal SaaS platform is susceptible to a CSV formula injection vulnerability within its export functionality. The root cause is the lack of proper validation or sanitization of user-controlled data, specifically event names or templates within the Tenders module , before they a...

CVE-2026-111037

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Tenders module of the Coupa Supplier Portal SaaS platform. The root cause is the lack of proper output encoding or sanitization for the list_item_function parameter, which is reflected in the server's response and embedded directl...

tenders-info.ru Cross Site Scripting vulnerability OBB-2955540

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

coalindiatenders.nic.in Improper Access Control vulnerability OBB-1384686

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...