Which Open Web Application Security Project (OWASP) implements a web application full of known vulnerabilities?

WebBugs is not an OWASP project; the term refers to tracking pixels (1x1 images) used for web analytics and surveillance, not a vulnerability training application.

WebGoat is an OWASP-maintained, intentionally vulnerable web application that teaches developers and testers how to exploit weaknesses such as SQL injection, XSS, and broken authentication through interactive lessons. It is designed to run locally so that users can attack real application code without legal or ethical risk. It directly maps its lessons to the OWASP Top 10 and other vulnerability categories, making it the canonical OWASP learning platform for web security.

VULN_HTML is not a real OWASP project or recognized security tool - this is a fabricated distractor.

WebScarab was an OWASP web application proxy and intercepting tool used for testing, not a vulnerable target application designed for practice attacks.