VulnerableApp

This release introduces major enhancements to VulnerableApp, including the addition of LLM-focused security labs, new vulnerabilities, and improvements across the platform.

🔥 Highlights

🤖 Introducing LLMForge (NEW)

We are excited to launch LLMForge, a new application within VulnerableApp focused on LLM (Large Language Model) security vulnerabilities.

LLMForge enables learners and security researchers to:

Explore real-world LLM attack vectors
Understand emerging risks like prompt injection, data leakage, and unsafe tool usage
Practice exploiting and mitigating vulnerabilities in AI-powered applications

LLMForge is accessible via the Docker setup. Simply run:
docker-compose up -d
and access VulnerableApp along with LLMForge at:
http://localhost

This marks a significant step in expanding VulnerableApp beyond traditional web security into AI security education.

🛡️ New Vulnerabilities Added

🔓 IDOR (Insecure Direct Object Reference)

Added a complete IDOR vulnerability lab
Includes multiple levels for progressive learning
Refactored for better clarity and extensibility

🪟 Clickjacking

Introduced a new Clickjacking vulnerability scenario
Includes both vulnerable and fixed implementations for comparison

🧬 LDAP Injection

New LDAP Injection vulnerability added
Improved level design and feedback based on testing iterations

🧰 Improvements & Fixes

✅ Fixed Clickjacking vulnerability implementation in modern UI
✅ Added ping utility to Docker base image (fixes Command Injection lab issues)
✅ Improved documentation for modern UI testing workflows
✅ Updated internationalized README files to align with the English version
✅ General code refactoring and stability improvements across vulnerability modules

👥 New Contributors

We’re thrilled to welcome new contributors to the project 🎉
@Roshan1299 – Clickjacking vulnerability
@monssefbaakka – i18n documentation updates
@PrakarshSrivastav – Testing scripts & documentation
@zeel2104 – Docker fixes for command injection

Special Mention

Special thanks to @antriksh-9 and @Roshan1299 for their outstanding contributions to this release.
@antriksh-9 delivered high-impact work by building core vulnerability labs including IDOR and LDAP Injection, significantly strengthening the platform’s security coverage.
@Roshan1299 contributed the Clickjacking vulnerability, adding important client-side attack scenarios to the application.

📦 Full Changelog
👉 https://github.com/SasanLabs/VulnerableApp/compare/1.13...2.0.1