WebGoat is deliberately insecure. Here is a list of known vulnerabilities:

[blackduck-joe]

Describe what content should be added :

I suspect no one will ever do this, but it is surprising that"something" was deliberately done, but there is no list of that which was so intentionally added.

So the content for the title suggestion above need merely be an intro sentence followed by a bullet list of the CVEs known to be within the latest version...

Context :
Section: (eg '04-foundations/03-security-principles')

[jgadsden]

Thanks for the suggestion @blackduck-joe Is this something that should be directed towards the WebGoat project itself? If so then the issues for that are here: https://github.com/WebGoat/WebGoat/issues?page=1&q=is%3Aissue+is%3Aopen

[jgadsden]

I have created an issue in the WebGoat repo for this: List of WebGoat vulnerabilities and/or lessons #1967