cPanel prior to 74.0.8 allows self XSS in the WHM "Create a New Account" interface (SEC-428).
cpanel cpanel