cPanel prior to 71.9980.37 allows self XSS in the WHM Backup Configuration interface (SEC-421).
cpanel cpanel