cPanel prior to 62.0.4 allows self XSS on the webmail Password and Security page (SEC-199).
cpanel cpanel