Project WAVSEP currently includes the following test cases:
Vulnerabilities:

Reflected XSS: 66 test cases, implemented in 64 jsp pages (GET & POST)
Error Based SQL Injection: 80 test cases, implemented in 76 jsp pages (GET & POST )
Blind SQL Injection: 46 test cases, implemented in 44 jsp pages (GET & POST )
Time Based SQL Injection: 10 test cases, implemented in 10 jsp pages (GET & POST )


False Positives:

7 different categories of false positive Reflected XSS vulnerabilities (GET & POST )
10 different categories of false positive SQL Injection vulnerabilities (GET & POST)


Download
http://code.google.com/p/wavsep/downloads/list