cPanel prior to 62.0.17 allows demo accounts to execute code via an NVData_fetchinc API call (SEC-233).
cpanel cpanel