cPanel prior to 76.0.8 has Self XSS in the WHM Additional Backup Destination field (SEC-459).
cpanel cpanel