A reflected Cross‑Site Scripting (XSS) flaw exists in the Tenders module of Coupa’s Total Spend Management Platform. The flaw occurs because the list_item_function parameter is inserted into a JavaScript event handler without proper encoding or sanitisation. When an attacker contains malicious code in a specially crafted URL, a legitimate user who opens that URL can trigger arbitrary scripts to run in their browser. The attacker could then act on the victim’s behalf, expose data, or alter the user interface.

Coupa’s Total Spend Management Platform, specifically the Tenders module of the Supplier Portal SaaS. No version information is available, so any installation of this platform that includes the Tenders component is potentially affected.

The CVSS score of 5.1 indicates moderate severity, while the EPSS score is not available and the vulnerability is not listed in CISA KEV. The attack vector requires an attacker to place a malicious URL, which a low‑privileged user may open; thus the risk is moderate but realistic, especially in environments where users frequently receive links. Successful exploitation would compromise the integrity and confidentiality of the victim’s session and could undermine business processes.