cPanel before 60.0.25 allows self XSS in the alias upload interface (SEC-184).Referenceshttps://documentation.cpanel.net/display/CL/60+Change+Log
