Zoho ManageEngine ADSelfService Plus 5.7 before build 5702 has XSS in the self-update layout implementation.
zohocorp manageengine adselfservice plus 5.7