What is the reason for this? Is Common Criteria not suitable for web applications? What are the main problems?
No. In practice, the Common Criteria is not a great tool for assuring or evaluating the security of a web application. There are a number of reasons:
To summarize, Common Criteria primarily solves a compliance problem, not a security problem.
You can certify pretty much anything with Common Criteria, by its very nature. The first step of Common Criteria is to define what the system being certified looks like, and then to lay out what the appropriate security yardsticks will be for that system. If you had an IP-enabled screwdriver, you could get it certified under Common Criteria (assuming it was secure enough, of course).
Looking at the Common Criteria Certified Products list, for example, I see BEA WebLogic and IBM WebSphere certified. Those are web application platforms, one step up from what you're looking for. I also see Splunk on the list, which could be considered a web application.
Now, I don't know for sure what you're looking for when you say web application. But the sole common factor among every entry on the CC Certified Product list is that someone wanted to sell it to people who made security certification part of their evaluation and purchase process. If you mean web applications like, say, Google Docs or Google Mail - Google isn't selling them to anyone. Sure, they sell the service, but not the applications. So there's no need to get them CC certified, because there's no benefit in doing so.
Hope that helps!