VulnSchool is an intentionally vulnerable Learning Management System built on Node.js, Express, and MongoDB. It simulates a real university student portal — complete with course registration, grade results, profile management, file uploads, and an admin panel — but with 31 intentional security vulnerabilities baked in across the full stack.
It was built to give security students and CTF players a realistic, full-featured target to practice against — demonstrating how real-world vulnerabilities appear in modern web applications. It also ships with a built-in SOC dashboard so defenders can monitor and detect attacks in real time.
Vulnerabilities covered include: IDOR, Broken Function Level Authorization (BFLA), Mass Assignment, Stored XSS, SSRF, Path Traversal, Insecure File Upload, JWT misconfigurations, Broken Access Control, Race Conditions, User Enumeration, and more.