cPanel prior to 67.9999.103 allows SQL injection during eximstats processing (SEC-276).
cpanel cpanel