cPanel prior to 74.0.8 allows stored XSS in WHM "File and Directory Restoration" interface (SEC-441).
cpanel cpanel