The bin/mkvhostspasswd script in cPanel prior to 11.54.0.4 discloses password hashes (SEC-73).
cpanel cpanel