⚠️ INTENTIONALLY VULNERABLE APPLICATION — FOR SECURITY TESTING ONLY ⚠️

🛒 VulnShop

User Profile

FieldValue
ID1
Usernameadmin
Emailadmin@vulnerable.local
Passwordadmin123
Roleadmin

Try changing user_id in the URL to view other users' profiles.

🔓 Vulnerability Demo Pages

This application contains the following intentional vulnerabilities for scanner testing:

PageVulnerabilityCWE
Home (XSS)Reflected XSSCWE-79
Home (Debug)Information Disclosure (phpinfo)CWE-200
LoginSQL Injection, No brute-force protectionCWE-89
RegisterNo CSRF, Stored XSS, Plaintext PasswordCWE-352, CWE-79, CWE-256
Forgot PasswordPassword Disclosure, User EnumerationCWE-256, CWE-203
Product (SQLi)SQL Injection (UNION)CWE-89
SearchReflected XSS + SQL InjectionCWE-79, CWE-89
CommentsStored XSS, No CSRFCWE-79, CWE-352
ProfileIDOR, Sensitive Data ExposureCWE-639, CWE-200
Admin PanelBroken Access Control, Command Injection, Path TraversalCWE-284, CWE-78, CWE-22
File UploadUnrestricted File UploadCWE-434
XML ParserXXE InjectionCWE-611
URL FetcherSSRFCWE-918
DeserializeInsecure DeserializationCWE-502
RedirectOpen RedirectCWE-601
VulnShop — Intentionally Vulnerable PHP App for Security Testing | DO NOT USE IN PRODUCTION