A reflected Cross-Site Scripting (XSS) vulnerability exists in the Tenders module of the Coupa Supplier Portal SaaS platform. The flaw occurs because the `list_item_function` parameter is reflected in the server response without proper sanitization and is embedded within a JavaScript event handler context. An attacker with a low-privileged account can craft a malicious URL that executes arbitrary scripts in the victim's browser when opened. Exploitation could lead to unauthorized actions on behalf of the victim, information disclosure, or UI manipulation.