cPanel prior to 74.0.0 allows stored XSS in the WHM File Restoration interface (SEC-367).
cpanel cpanel