bWAPP

bWAPP, or a buggy web application, is a free and open source deliberately insecure web application.