cPanel prior to 74.0.8 allows self XSS in the WHM Security Questions interface (SEC-433).
cpanel cpanel