cPanel prior to 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487).
cpanel cpanel