Xtreme Vulnerable Web Application (XVWA)
XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.
XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.
Checked October 2026.
XVWA is an intentionally vulnerable web application built with PHP and MySQL designed for security education and training purposes.
The application contains multiple security vulnerabilities that allow users to practice identifying and exploiting common web application security issues in a controlled environment.
Key vulnerabilities included in XVWA:
The application is specifically designed to be "extremely vulnerable" and should only be deployed in local or controlled environments for educational purposes. It serves as a hands-on learning platform for security enthusiasts to develop application security skills using various testing tools and techniques.
No core features are listed for this product yet, so check the vendor's documentation for the full feature list.
No integrations are listed for this product yet. Check the vendor's documentation, or ask the vendor which integrations and APIs it supports.
Common questions about Xtreme Vulnerable Web Application (XVWA): features, pricing and alternatives.
Xtreme Vulnerable Web Application (XVWA) is a product in the Cyber Range Training category. It covers MySQL, SQL Injection and PHP.
Xtreme Vulnerable Web Application (XVWA) is free. Download and setup instructions are at https://github.com/s4n7h0/xvwa/.
Alternatives to Xtreme Vulnerable Web Application (XVWA) listed on CybersecTools:
Compare all Xtreme Vulnerable Web Application (XVWA) alternatives at https://cybersectools.com/alternatives/xtreme-vulnerable-web-application-xvwa
Xtreme Vulnerable Web Application (XVWA) is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.
Side by side: features, pricing model and the company behind each one.
Korean cyber-security challenge platform for exploiting and defending web application vulnerabilities.
A free online wargame for practicing hacking skills and learning security concepts.
An educational workshop providing hands-on training materials, lab environments, and tools for learning local privilege escalation techniques on Windows and Linux systems.
A collection of 20 cross-site scripting challenges covering various XSS attack vectors and filtering bypass techniques for educational purposes.
Solve password-riddles on a website without logins or ads.
Gamified, live-data cyber skills training & crowdsourcing platform.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,030 products.
Connect your AI
