Damn Vulnerable Web Application (DVWA) is a PHP/MariaDB web application that is damn vulnerable. Its main goal is to be an aid for security professionals to test their skills and tools in a legal ...
For now, it does not support navigation properties, complex types, owned types, shadow properties, or inheritance, but they are in the roadmap.