# Xtreme Vulnerable Web Application (XVWA)

Xtreme Vulnerable Web Application (XVWA) is a Cyber Range Training product. It runs on-premises. Pricing is free.

XVWA is an intentionally vulnerable PHP/MySQL web application designed for security education, containing multiple common web vulnerabilities for hands-on learning and practice.

Checked October 2026.

## What is Xtreme Vulnerable Web Application (XVWA)?

XVWA is an intentionally vulnerable web application built with PHP and MySQL designed for security education and training purposes.

The application contains multiple security vulnerabilities that allow users to practice identifying and exploiting common web application security issues in a controlled environment.

Key vulnerabilities included in XVWA:
- SQL Injection and Error-Based SQL Injection
- Blind OS Command Injection
- XPATH Injection and Formula Injection
- PHP Object Injection
- Unrestricted File Upload
- Cross-Site Scripting (Reflected, Stored, and DOM-Based)
- Server-Side Request Forgery (SSRF) including Cross-Site Port Attacks
- File Inclusion vulnerabilities
- Session management issues
- Insecure Direct Object Reference
- Missing Functional Level Access Control
- Cross-Site Request Forgery (CSRF)
- Cryptography implementation flaws

The application is specifically designed to be "extremely vulnerable" and should only be deployed in local or controlled environments for educational purposes. It serves as a hands-on learning platform for security enthusiasts to develop application security skills using various testing tools and techniques.

Tags: MySQL, SQL Injection, PHP, Education, SSRF, XSS, CSRF, Vulnerable Applications

## Quick facts

- Category: [Human Risk](https://cybersectools.com/categories/human-risk) · [Cyber Range Training](https://cybersectools.com/categories/cyber-range)
- Deployment: On-Premises
- Company size fit: Startup, SMB, Mid-Market, Enterprise
- Pricing model: Free
- GitHub stars: 1,745
- Website: github.com

## Xtreme Vulnerable Web Application (XVWA) FAQ

### What is Xtreme Vulnerable Web Application (XVWA)?

Xtreme Vulnerable Web Application (XVWA) is a product in the Cyber Range Training category. It covers MySQL, SQL Injection and PHP.

### What is the pricing for Xtreme Vulnerable Web Application (XVWA)?

Xtreme Vulnerable Web Application (XVWA) is free. Download and setup instructions are at https://github.com/s4n7h0/xvwa/.

### What are alternatives to Xtreme Vulnerable Web Application (XVWA)?

Alternatives to Xtreme Vulnerable Web Application (XVWA) listed on CybersecTools:

1. [OffSec Proving Grounds](https://cybersectools.com/tools/offsec-proving-grounds) - Online lab platform offering hands-on penetration testing practice machines for OSCP prep (Commercial)
2. [Payatu BugBazaar](https://cybersectools.com/tools/payatu-bugbazaar) - Intentionally vulnerable mobile app for practicing Android and iOS penetration testing (Free)
3. [IronCircle Cybersecurity Training Platform](https://cybersectools.com/tools/ironcircle-cybersecurity-training-platform) - AI-powered browser-based cybersecurity training platform with labs and certs (Commercial)
4. [TryHackMe Cyber Security Training](https://cybersectools.com/tools/tryhackme-cyber-security-training) - Hands-on cybersecurity training platform with gamified labs and challenges (Commercial)
5. [Cybexer Cyber Ranges for Finance and Banking](https://cybersectools.com/tools/cybexer-cyber-ranges-for-finance-and-banking) - Cyber range platform for finance & banking sector security training (Commercial)

Compare all Xtreme Vulnerable Web Application (XVWA) alternatives at [https://cybersectools.com/alternatives/xtreme-vulnerable-web-application-xvwa](https://cybersectools.com/alternatives/xtreme-vulnerable-web-application-xvwa)

### What deployment and organization size does Xtreme Vulnerable Web Application (XVWA) fit?

Xtreme Vulnerable Web Application (XVWA) is available as on-premises software. It is listed for startups, small businesses, mid-market companies and enterprises. It is free.

## Compare Xtreme Vulnerable Web Application (XVWA) with similar solutions

- [Xtreme Vulnerable Web Application (XVWA) vs OffSec Proving Grounds](https://cybersectools.com/compare/offsec-proving-grounds-vs-xtreme-vulnerable-web-application-xvwa)
- [Xtreme Vulnerable Web Application (XVWA) vs Payatu BugBazaar](https://cybersectools.com/compare/payatu-bugbazaar-vs-xtreme-vulnerable-web-application-xvwa)
- [Xtreme Vulnerable Web Application (XVWA) vs IronCircle Cybersecurity Training Platform](https://cybersectools.com/compare/ironcircle-cybersecurity-training-platform-vs-xtreme-vulnerable-web-application-xvwa)

All alternatives to Xtreme Vulnerable Web Application (XVWA): [/alternatives/xtreme-vulnerable-web-application-xvwa](https://cybersectools.com/alternatives/xtreme-vulnerable-web-application-xvwa)

---

Source: https://cybersectools.com/tools/xtreme-vulnerable-web-application-xvwa

For AI agents: every CybersecTools shortlist is listed at https://cybersectools.com/shortlists.md, and any compare page has a Markdown copy too (add .md to its URL).

More on Xtreme Vulnerable Web Application (XVWA): funding, momentum, hiring and news, plus the full product and company record, are available through the Mandos MCP Server (paid plans), which connects to AI assistants: https://mandos.io/mcp?utm_source=cybersectools.com&utm_medium=product-md