Vulnerable Web App Open Source Projects
Discover 2 open source Vulnerable Web App repositories from GitHub, each with an analysis of what it does, key features, use cases and alternatives. Vulnerable Web App projects here are most often combined with Education, Security and Web App. Last updated October 25, 2026.
NodeGoat: Learn OWASP Top 10 Security in Node.js Apps
OWASP NodeGoat is a Node.js web application for learning how OWASP Top 10 risks affect web apps and how to address them. It pairs a deliberately vulnerable app with tutorials for hands-on security practice.
InactiveHealth 39/100
juice-shop: Practice Web Application Security with OWASP
OWASP Juice Shop is a deliberately insecure web application built with TypeScript for security training, awareness demos, CTFs, and security-tool testing. Its challenges cover the OWASP Top Ten and other real-world application flaws.
ActiveHealth 62/100