Zoho ManageEngine OpManager 12.3 before build 123239 allows SQL injection in the Alarms section.
zohocorp manageengine opmanager 12.3