For a demo purpose i need to install a vulnerable application and i tried using XAMP server but it opens up many ports and not safe to use it. so please recommend a server to launch a vulnerable demo application in an sophisticated org environment.
You should use a dedicated, separate virtual environment and not a system in your business environments.
If it's for a demo, you should use Virtualbox or similar hypervisor and run it in Host-Only network mode. Running a known-vulnerable service/system in a business environment is asking for trouble.