cPanel prior to 62.0.4 allows stored XSS in the WHM Account Suspension List interface (SEC-211).
cpanel cpanel