cPanel prior to 68.0.15 allows string format injection in dovecot-xaps-plugin (SEC-318).
cpanel cpanel