Reflected XSS Vulnerability in Coupa Supplier Portal's Tenders Module

CVE-2026-111037

What is CVE-2026-111037?

This vulnerability is a reflected Cross-Site Scripting (XSS) flaw found in the Tenders module of the Coupa Supplier Portal. It occurs when the list_item_function parameter is reflected in the server’s response without adequate output encoding or sanitization, leading to the embedding of potentially harmful JavaScript within a JavaScript event handler. An attacker, even with low privileges, can craft a malicious URL that, when accessed by a victim, executes arbitrary scripts in their browser context. This exploitation could enable attackers to perform actions on behalf of the victim, disclose sensitive information, or alter the user interface.

References