Behind the Message: Two Critical XSS Vulnerabilities in Zoho’s Web Applications