A vulnerability in Zimbra Mail server allows an attacker to inject malicious JavaScript code into the application. This can be done by sending a specially crafted URL to the application. The URL contains a malicious payload which is executed when the user visits the page. The payload can be used to execute arbitrary JavaScript code, which can be used to steal user data or perform other malicious activities.