Zoho ManageEngine OpManager 12.3 prior to 123238 allows SQL injection via the getGraphData API.
zohocorp manageengine opmanager 12.3