md-webscan is a high quality CGI vulnerability scanner. It is well written, easily extensible, and has a few nifty options.