OWASP WebGoat

Deliberately insecure web application to teach web application security lessons

Category
Intentionally Vulnerable Applications
Website
https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project
Source code
https://github.com/WebGoat/WebGoat
Price
Free