There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, who was the first to discover them [Surely, it wasn't a single person], and when they were first discovered [Surely, they weren't discovered at the same time], and so on.

closed as too broad by Ohnana, Matthew, Tobi Nary, RoraΖ, Mike Ounsworth Apr 7 '16 at 2:41

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Have a look here and here. It this what you are after for? – Tobi Nary Mar 19 '16 at 23:10

You can

Those two links should be fine to answer questions you might have about individual vulnerabilities - not only constrained to web applications - although they do not usually disclose the actual person that found the vulnerability.


Wikipedia and Google would be my choice, as there isn't one authoritative website including the history of vulnerability types.

The usual places that list vulnerability types generally do not include a history section. For example, here is the CWE on XSS, here is the CAPEC on XSS, and here is the OWASP page on XSS.

The CVE lists suggested by others list individual vulnerabilities (but not vulnerability classes). If you want to know who discovered specific vulnerabilities in specific applications they are a great place to look though.

Wikipedia on the other hand has a history or background section for most vulnerability types, eg on XSS:

Microsoft security-engineers introduced the term "cross-site scripting" in January 2000.
XSS vulnerabilities have been reported and exploited since the 1990s.

Or on SQL Injection:

The first public discussions of SQL injection started appearing around 1998.[3] For example, a 1998 article in Phrack Magazine.[4]

A google search for the history of CSRF would for example lead you to this exchange.

You would need to verify the claims yourself though.


CVE Details is a great site listing vulnerabilities narrowed down to manufacture, product and version.

In addition it also shows the published dates in any results, which is very useful.

Not the answer you're looking for? Browse other questions tagged or ask your own question.