Zoho ManageEngine ADSelfService Plus prior to 6112 is vulnerable to mail spoofing.
zohocorp manageengine admanager plus
zohocorp manageengine admanager plus 6.1