GitHub repository: DryRunSecuritySandbox/damn-vulnerable-stateful-web-app
Description: Short and simple vulnerable PHP web application that naïve scanners found to be perfectly safe