Which Open Web Application Security Project (OWASP) implements a web application full of known vulnerabilities?

WebBugs refers to small invisible tracking images historically used for surveillance in email and web pages - it is not an OWASP project or a vulnerable training application.

WebGoat is an OWASP-maintained Java-based web application intentionally designed with known vulnerabilities such as SQL injection, XSS, and broken authentication. It provides hands-on lessons that allow testers and developers to learn attack and defense techniques without targeting real systems.

VULN_HTML is not a recognized OWASP project or standard tool name; it does not exist as a real vulnerability training application.

WebScarab was an OWASP tool that functioned as an HTTP/HTTPS proxy for intercepting and analyzing web traffic - it is a testing proxy, not a vulnerable target application.