2 repositories on SrcLog
OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Improve it.
VulnerableApp-facade is probably most modern lightweight distributed farm of Vulnerable Applications built for handling wide range of vulnerabilities across tech stacks.