Q:

Vulnerable Java applications? 

I am looking for some open source/free vulnerable Java based applications.  It can be web application, desktop application or any other.  I need them to do some experiments in my research work.  They could be very small or medium size but it's nice if it is like real world application.  
The vulnerabilities may include XSS attacks, accessing unauthorized data, SQL-injection etc. 
I already tried OWASP applications but need some more.  Could somebody please suggest where can I find such vulnerable/exploitable Java applications? 

A:

If you are new to hunting I recommend starting out with WebGoat or Damn Vulnerable WebApp (DVWA).   This is because it frames each vulnerability nicely,  you just have to point and shoot.   You can practice exploitation, and working with a real vulnerability. " The shooting range"
There are real applications that where intentionally written to be insecure (Like the Hacme series, which is under SASS Tools).   The Dojo has a collection of these apps loaded onto a VM as well as tools to audit them.   This is really the 2nd step because now you have to find where to shoot. " Hunting on the farm"
The 3rd step is going out and finding a real application.   Search github/sourceforge/bitbucket/ect for web applications that are less than a year old and aren't that popular.    These apps will vary,  but most often then will be very insecure. " Hunting in the wild"
After that start working your way up to more popular applications,  get CVE numbers,  write exploit code, and explore newly developed exploitation techniques: exploit-db.com .   "It gets more wild..."

