CVE-2026-111040

MediumCVSS 5.1/10Last modified Nov 12, 2026

Description

The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inject unsanitised HTML content which is stored in the database and subsequently rendered in other users’ browsers, affecting the display of content within the application.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-80

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
Coupa	Coupa Total Spend Management Platform	< 04/11/2026

References

https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-coupas-total-spend-management-platform

Timeline

Published: Nov 4, 2026
Last modified: Nov 12, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1110414.9The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwi CVE-2026-1110447.6Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certifica CVE-2026-1110457.5CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypass CVE-2026-1110462.3FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive no CVE-2026-1110488.4FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.9, the admin/support/note_create endpoint stores CVE-2026-111056.5Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th CVE-2026-1110536.9FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/template_CVE-2026-1110566.9FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/cre CVE-2026-11105710.0Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.4, a missing comma in B CVE-2026-1110589.8Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployment CVE-2026-1110596.1Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown convert CVE-2026-111066.5Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf