I am confused about why websites use CORS. I know CORS provide some protocols through which website can call the resources from other domains, but is it possible to call the resource without CORS?
If it is, then what vulnerability can it cause?
You can send GET and POST requests cross domain even if the target does not use CORS, but there are some restrictions. Most importantly, you can not read the response. This restriction is built into browsers as part of the Single Origin Policy (SOP) and it protects against data leaking across domains. However, it also stops you from publiching an API that can be read from any domain.
CORS gives you the option to remove that restriction, i.e. allowing the domain that is hosting the API to announce to browsers that it allows cross domain calls from either all or some domains. So I wouldn't say CORS is protecting against a specific vulnerability. Rather it allows you to open your API:s up to the world. Not having a CORS policy at all will always be the most restrictive option.