Local only This shop is broken on purpose for scanner practice. Keep it on 127.0.0.1 — don't put it online.
Vulnshop. second-hand merch, first-hand mistakes
XXE XML Parser

Shop / VS-008

XXE XML Parser

$29.99

In stock — ships when you least expect it

Parses external entities for you

Use admin / admin123, or any account from the back office.

Lab note: product ids are sequential and unguarded, so /product/1 through /product/12 all resolve. Order receipts behave the same way — see /api/orders/1.