The XSS probe {{7*7}} renders as 49 here - that is server-side template injection, not XSS. One probe, two bug classes (see WEB 07).
{{7*7}}
RatXSS Dojo · HackXpert Coaching · The XSS Rat · authorized lab use only