Both Dominick Baer and Anil John are pointing to Foundstone's new sample web application (written in ASP.NET and C#) that demonstrates common security vulnerabilities plus helping developers create secure software.
From Foundstone's site:
"Hacme Bankâ„¢ is designed to teach application developers, programmers, architects and security professionals how to create secure software. Hacme Bank simulates a "real-world" online banking application, which was built with a number of known and common vulnerabilities such as SQL injection and cross-site scripting. This allows users to attempt real exploits against a web application and thus learn the specifics of the issue and how best to fix it. Foundstone uses this application extensively in our Ultimate Web Hacking and Building Secure Software training classes. "
Get more information here (the application and a User and Solutions Guide).
