cPanel prior to 70.0.23 allows stored XSS in via a WHM "Reset a DNS Zone" action (SEC-412).
cpanel cpanel