cPanel prior to 59.9999.145 allows stored XSS in the WHM tail_upcp2.cgi interface (SEC-156).
cpanel cpanel