cPanel prior to 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188).
cpanel cpanel