Measured benchmark · 2026-10-24
Measured on real code, published as-is.
We scan pinned open-source projects: intentionally vulnerable apps to measure what we catch, and maintained production apps to measure noise. These are the latest results, including what we miss.
Documented flaws found43 / 4341 of them block the release gate (HIGH or CRITICAL).
Clean projects not failed14 / 173 failed on issues we reviewed as real.
Real-incident snippets caught86%102 of 118 flagged HIGH/CRITICAL, 99% incl. MEDIUM. The misses are listed in What We Don't Check.
Median engine time1.6sAcross 28 projects. The largest, 2,481 files, took 40.7s.
Known vulnerabilities in intentionally vulnerable apps
Each flaw is located in the app's source; it counts as found only if Zelsis reports that class of issue in that file.
| Project | Flaw | File | Result |
|---|---|---|---|
| OWASP/NodeGoat | Server-side JS injection via eval(req.body.preTax) | app/routes/contributions.js | Found · blocks |
| OWASP/NodeGoat | NoSQL injection through $where string | app/data/allocations-dao.js | Found · blocks |
| OWASP/NodeGoat | Open redirect via res.redirect(req.query.url) | app/routes/index.js | Found · blocks |
| OWASP/NodeGoat | SSRF via needle.get(url + symbol) | app/routes/research.js | Found · blocks |
| OWASP/NodeGoat | Hardcoded session cookie secret | config/env/all.js | Found · blocks |
| appsecco/dvna | SQL injection by string concatenation in sequelize.query | core/appHandler.js | Found · blocks |
| appsecco/dvna | Command injection: exec('ping -c 2 ' + req.body.address) | core/appHandler.js | Found · blocks |
| appsecco/dvna | Insecure deserialization with node-serialize unserialize | core/appHandler.js | Found · blocks |
| appsecco/dvna | XXE: libxmljs parseXmlString with noent:true | core/appHandler.js | Found · blocks |
| appsecco/dvna | Open redirect via res.redirect(req.query.url) | core/appHandler.js | Found · warning |
| appsecco/dvna | Code injection via mathjs.eval(req.body.eqn) | core/appHandler.js | Found · blocks |
| juice-shop/juice-shop | SQL injection in login query template literal | routes/login.ts | Found · blocks |
| juice-shop/juice-shop | Union SQL injection in product search | routes/search.ts | Found · blocks |
| juice-shop/juice-shop | Hardcoded RSA private key for JWT signing | lib/insecurity.ts | Found · blocks |
| juice-shop/juice-shop | MD5 password hashing | lib/insecurity.ts | Found · blocks |
| juice-shop/juice-shop | SSRF via fetch(user-supplied imageUrl) | routes/profileImageUrlUpload.ts | Found · blocks |
| WebGoat/WebGoat | SQL injection: string-built query passed to Statement.executeQuery | src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson5a.java | Found · blocks |
| WebGoat/WebGoat | SQL injection in access_log search | src/main/java/org/owasp/webgoat/lessons/sqlinjection/introduction/SqlInjectionLesson10.java | Found · blocks |
| WebGoat/WebGoat | Java deserialization with ObjectInputStream.readObject on user data | src/main/java/org/owasp/webgoat/lessons/deserialization/InsecureDeserializationTask.java | Found · blocks |
| WebGoat/WebGoat | XXE: XMLInputFactory without disabling external entities | src/main/java/org/owasp/webgoat/lessons/xxe/CommentsCache.java | Found · blocks |
| OWASP/railsgoat | SQL injection: User.where with interpolated params | app/controllers/users_controller.rb | Found · blocks |
| OWASP/railsgoat | Mass assignment: params.require(:user).permit! | app/controllers/users_controller.rb | Found · blocks |
| OWASP/railsgoat | Command injection: system() with interpolated file name | app/models/benefits.rb | Found · blocks |
| OWASP/railsgoat | Insecure deserialization: Marshal.load(params[:user]) | app/controllers/password_resets_controller.rb | Found · blocks |
| OWASP/railsgoat | Stored XSS via html_safe on user first name | app/views/layouts/shared/_header.html.erb | Found · blocks |
| digininja/DVWA | SQL injection: $id interpolated into query | vulnerabilities/sqli/source/low.php | Found · blocks |
| digininja/DVWA | Command injection: shell_exec('ping ' . $target) | vulnerabilities/exec/source/low.php | Found · blocks |
| digininja/DVWA | File inclusion: include($file) from request | vulnerabilities/fi/index.php | Found · blocks |
| digininja/DVWA | Reflected XSS: $_GET['name'] echoed into HTML | vulnerabilities/xss_r/source/low.php | Found · blocks |
| digininja/DVWA | Unrestricted file upload (no type/extension check) | vulnerabilities/upload/source/low.php | Found · blocks |
| adeyosemanputra/pygoat | SQL injection: concatenated query passed to objects.raw | introduction/views.py | Found · blocks |
| adeyosemanputra/pygoat | Insecure deserialization: pickle.loads / yaml.load with yaml.Loader | introduction/views.py | Found · blocks |
| adeyosemanputra/pygoat | Code injection: eval() on request value | introduction/views.py | Found · blocks |
| adeyosemanputra/pygoat | SSRF: requests.get(request.POST["url"]) | introduction/views.py | Found · blocks |
| adeyosemanputra/pygoat | MD5 password hashing | introduction/views.py | Found · blocks |
| anxolerd/dvpwa | SQL injection: % string formatting in INSERT | sqli/dao/student.py | Found · blocks |
| anxolerd/dvpwa | MD5 password hashing | sqli/dao/user.py | Found · blocks |
| anxolerd/dvpwa | Template autoescaping disabled (autoescape=False) | sqli/app.py | Found · blocks |
| payatu/diva-android | SQL injection: search text concatenated into rawQuery | app/src/main/java/jakhar/aseem/diva/SQLInjectionActivity.java | Found · blocks |
| payatu/diva-android | Password stored in plaintext SharedPreferences | app/src/main/java/jakhar/aseem/diva/InsecureDataStorage1Activity.java | Found · blocks |
| dineshshetty/Android-InsecureBankv2 | Username and password written to Logcat | InsecureBankv2/app/src/main/java/com/android/insecurebankv2/DoLogin.java | Found · warning |
| dineshshetty/Android-InsecureBankv2 | Credentials in world-readable SharedPreferences | InsecureBankv2/app/src/main/java/com/android/insecurebankv2/MyBroadCastReceiver.java | Found · blocks |
| prateek147/DVIA-v2 | Password saved to a plist in Documents | DVIA-v2/DVIA-v2/Vulnerabilities/Insecure Data Storage/Controller/PListViewController.swift | Found · blocks |