Zoho ManageEngine ADSelfService Plus before build 5708 has XSS via the mobile app API.
Published April 25, 2019.
Zohocorp Manageengine Adselfservice Plus