CVE-2026-111038

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

EUVD-2026-116822

CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are not properly validated or sanitised before being included in C...

CVE-2026-111038

The Coupa Supplier Portal SaaS platform is susceptible to a CSV formula injection vulnerability within its export functionality. The root cause is the lack of proper validation or sanitization of user-controlled data, specifically event names or templates within the Tenders module , before they a...

CVE-2026-111037

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Tenders module of the Coupa Supplier Portal SaaS platform. The root cause is the lack of proper output encoding or sanitization for the list_item_function parameter, which is reflected in the server's response and embedded directl...