- Home
- Security Operations
- Cyber Range Training
- Xtreme Vulnerable Web Application (XVWA)

Xtreme Vulnerable Web Application (XVWA)
XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.

Xtreme Vulnerable Web Application (XVWA)
XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.
Xtreme Vulnerable Web Application (XVWA) Description
XVWA is an intentionally vulnerable web application built with PHP and MySQL designed for security education and training purposes. The application contains multiple security vulnerabilities that allow users to practice identifying and exploiting common web application security issues in a controlled environment. Key vulnerabilities included in XVWA: - SQL Injection and Error-Based SQL Injection - Blind OS Command Injection - XPATH Injection and Formula Injection - PHP Object Injection - Unrestricted File Upload - Cross-Site Scripting (Reflected, Stored, and DOM-Based) - Server-Side Request Forgery (SSRF) including Cross-Site Port Attacks - File Inclusion vulnerabilities - Session management issues - Insecure Direct Object Reference - Missing Functional Level Access Control - Cross-Site Request Forgery (CSRF) - Cryptography implementation flaws The application is specifically designed to be "extremely vulnerable" and should only be deployed in local or controlled environments for educational purposes. It serves as a hands-on learning platform for security enthusiasts to develop application security skills using various testing tools and techniques.
FEATURED
Password manager with end-to-end encryption and identity protection features
VPN service providing encrypted internet connections and privacy protection
Fractional CISO services for B2B companies to accelerate sales and compliance
Stay Updated with Mandos Brief
Get the latest cybersecurity updates in your inbox
TRENDING CATEGORIES
POPULAR
Security platform that provides protection, monitoring and governance for enterprise generative AI applications and LLMs against various threats including prompt injection and data poisoning.
A threat intelligence aggregation service that consolidates and summarizes security updates from multiple sources to provide comprehensive cybersecurity situational awareness.
Fabric Platform is a cybersecurity reporting solution that automates and standardizes report generation, offering a private-cloud platform, open-source tools, and community-supported templates.
A weekly newsletter providing cybersecurity leadership insights, industry updates, and strategic guidance for security professionals advancing to management positions.