cPanel prior to 62.0.17 allows self XSS in the WHM cPAddons showsecurity interface (SEC-217).
cpanel cpanel