Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution.
CWE-434