cPanel prior to 70.0.23 allows stored XSS via a WHM Synchronize DNS Records action (SEC-377).
cpanel cpanel