total_spend_management_platform vulnerabilities
CVEs whose affected-version data names the total_spend_management_platform package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
4 CVEsRSS
CVE-2026-111040Medium· 5.1Multiple vulnerabilities in Coupa’s Total Spend Management Platform
The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other u…
CVE-2026-111038High· 7.3Multiple vulnerabilities in Coupa’s Total Spend Management Platform
CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because certain user-controlled data, such as event names or templates within the Tenders module, are no…
CVE-2026-111036High· 8.4Multiple vulnerabilities in Coupa’s Total Spend Management Platform
Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functionality available in the ‘Contracts > Templates’ section. The vulnerability is due to insufficient…
CVE-2026-111037Medium· 5.1Multiple vulnerabilities in Coupa’s Total Spend Management Platform
A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability arises because the `list_item_function` parameter is reflected in the server’s response without prop…