← all datasets
from the project README
◆ Vulnerable targets & payloads
Vulhub
MITHundreds of pre-built vulnerable environments, one docker-compose file per CVE — targets for testing scanners and exploit detection.
Summary
Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments. With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required.
- Formats
app- License
- MIT
- Added
- 2026-09-10
Get it
From the project’s own instructions where it documents any; otherwise a plain clone.
-
$ git clone --depth 1 https://github.com/vulhub/vulhub
-
$ cd vulhub/langflow/CVE-2025-3248 && docker compose up -d
One directory per vulnerability (the README's example shown). `docker compose down -v` tears it down.
Contents
2,879 files 182.5 MB repository
-
.png699 -
.md674 -
(no ext)469 -
.yml351 -
.py119 -
.sh100 -
.java95 -
.xml75
Use it with
Commands are curated, not yet run by us.
nuclei — Scan the target once it is running locally (adjust the port to the one you exposed).
$ nuclei -u http://127.0.0.1:3000
OWASP ZAP — Run ZAP's passive baseline scan against the locally running target.
$ docker run --rm -t ghcr.io/zaproxy/zaproxy:stable zap-baseline.py -t http://host.docker.internal:3000