CVE-2026-111040

UNKNOWN 0.0

Multiple vulnerabilities in Coupa’s Total Spend Management Platform

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.

CWE	CWE-80
Vendor	coupa
Product	coupa total spend management platform
Published	Nov 4, 2026

Stay Ahead of the Next One

Get instant alerts for coupa coupa total spend management platform

Be the first to know when new unknown vulnerabilities affecting coupa coupa total spend management platform are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Coupa / Coupa Total Spend Management Platform

0 < 04/11/2026

References

NVD ↗ CVE.org ↗ EPSS Data ↗

incibe.es: https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

Credits

David Sacristán Manzanares