cPanel prior to 74.0.8 allows self stored XSS on the Security Questions login page (SEC-446).
cpanel cpanel