VLC 2.2.1 - Web interface - XSS injection via metadata

1- Launch: vlc.exe --http-host=127.0.0.1 --http-port=8080 --http-password=andrea

2- Open Browser and go to localhost:8080 (for more info see https://wiki.videolan.org/Documentation:Modules/http_intf/)

3- Then left username blank and password andrea

4- Select poc.mp3 (attached) file

5- See Attached image

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information