CVE-2016-8634

CVE-2016-8634 describes a stored Cross-Site Scripting (XSS) vulnerability in Foreman version 1.14.0. This flaw allows an attacker to inject malicious HTML into an organization or location name, which is then rendered in an alertbox on the /organizations/id/step2 page when a user is directed to that specific URL. The vulnerability has a CVSSv3 score of 5.4 (Medium), indicating a low attack complexity and requiring user interaction, but with potential for low impact on confidentiality and integrity. The attack vector is network-based, and it requires low privileges to execute. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.