In Zoho ManageEngine Application Manager 13.1 Build 13100 an authenticated user with administrative privileges has the ability to add a widget on any dashboard. This widget can be a \Utility Widget\ with a \Custom HTML or Text\ field. Once this widget is created it will be loaded on the dashboard where it was added. An attacker can abuse this functionality by creating a \Utility Widget\ that contains malicious JavaScript code aka XSS.