VulnerableApp

v2.1.0 Feature

This release adds 8 notable features for engineering teams evaluating rollout.

Published 24d Vulnerability Scanning

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

security burpsuite css java javascript learn-security

+9 more

owasp owasp-zap payload-testing practice-hacking spring-boot test-vulnerability-scanning-tools vulnerability vulnerability-scanning vulnerable-application

Summary

AI summary

Broad release touches 🛡️ New Vulnerability Modules, 🏗️ Infrastructure & Tooling, 📚 Documentation & Community, and @luks-santos.

Full changelog

🎉 VulnerableApp 2.1.0

A major release packed with new vulnerability modules, infrastructure hardening, and strong community growth — 18 new contributors joined this cycle!

🛡️ New Vulnerability Modules

Authentication Vulnerability Module — full implementation, including a new "Low Iteration Password Hashing" challenge level (@ayash911, @aryankshl)
Cache Poisoning — brand new vulnerability class added (@luks-santos)
IDOR Module — enhanced with secure token handling (@Etoile-Bleu)
Cryptographic Failures — module enhancements (@aashpis)
Open Redirect — phishing-aware levels added (Levels 9, 10, 11) (@StevenTaing2, @Jhalak19-Sethi, @polcm005), plus payload/message-key improvements (@An16og)
Clickjacking — Challenge mode support added (@Clark1945)
Authentication — Challenge mode added (@luks-santos)

🧩 New Framework: Challenge Cards

A new @ChallengeCard annotation system was introduced for structured, gamified vulnerability challenges (@aryankshl) — now rolled out across multiple modules.

🏗️ Infrastructure & Tooling

Docker-based dashboard added (@harveenkaur2912)
Scanner benchmark framework for DAST/SAST coverage (@MukulGhare)
llmforge build migrated to a Docker Hub image for easier setup (@aruzaphoenix)
@Profile("public"/"unsafe") safeguards added across vulnerability controllers to separate safe/unsafe deployment modes (@prajp98)
Extra scanner path configuration support (@nguyenvulong)
@antriksh-9 — Enhanced the first-time contributor workflow
@MixhizoR — Added secure variants to Http3xxStatusCodeBasedInjection annotations

📚 Documentation & Community

New organizational usage documentation added (@CharanTeja-6825)
University of Adelaide added to the usage showcase (@aruzaphoenix)
Design documentation grammar and formatting cleanup (@muhammadrehanazam)
Facade schema population work (@saurabhkushwaha438)

📊 By the Numbers

~66 merged PRs
21 contributors
Continued momentum on infra hardening, new challenge types, and onboarding polish

Full changelog: https://github.com/SasanLabs/VulnerableApp/compare/2.0.1...2.1.0

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track VulnerableApp

Get notified when new releases ship.

About VulnerableApp

All releases →