Zoho ManageEngine Applications Manager prior to 16400 allows proxy.html DOM XSS.
zohocorp manageengine applications manager
zohocorp manageengine applications manager 16.3