Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
zohocorp manageengine adselfservice plus 5.7