VLC 2.2.1 - Web interface - XSS injection via metadata
1- Launch: vlc.exe --http-host=127.0.0.1 --http-port=8080 --http-password=andrea
2- Open Browser and go to localhost:8080 (for more info see https://wiki.videolan.org/Documentation:Modules/http_intf/)
3- Then left username blank and password andrea
4- Select poc.mp3 (attached) file
5- See Attached image