cPanel before 68.0.15 allows stored XSS during a cpaddons moderated upgrade (SEC-336).
Published August 2, 2019.
Cpanel Cpanel