GitHub repository: mkurz/play-webgoat
Description: A vulnerable Play application for attackers.