cPanel prior to 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501).
cpanel cpanel