Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.
zohocorp manageengine opmanager 12.5
zohocorp manageengine opmanager