Maketext in cPanel prior to 78.0.2 allows format-string injection in the Email store_filter UAPI (SEC-472).
cpanel cpanel