cPanel prior to 82.0.15 allows self XSS in the WHM Update Preferences interface (SEC-528).
cpanel cpanel