There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, who was the first to discover them [Surely, it wasn't a single person], and when they were first discovered [Surely, they weren't discovered at the same time], and so on.
closed as too broad by Ohnana, Matthew, Tobi Nary, RoraΖ, Mike Ounsworth Apr 7 '16 at 2:41
Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.
Those two links should be fine to answer questions you might have about individual vulnerabilities - not only constrained to web applications - although they do not usually disclose the actual person that found the vulnerability.
Wikipedia and Google would be my choice, as there isn't one authoritative website including the history of vulnerability types.
The CVE lists suggested by others list individual vulnerabilities (but not vulnerability classes). If you want to know who discovered specific vulnerabilities in specific applications they are a great place to look though.
Wikipedia on the other hand has a history or background section for most vulnerability types, eg on XSS:
Microsoft security-engineers introduced the term "cross-site scripting" in January 2000.
XSS vulnerabilities have been reported and exploited since the 1990s.
Or on SQL Injection:
The first public discussions of SQL injection started appearing around 1998. For example, a 1998 article in Phrack Magazine.
A google search for the history of CSRF would for example lead you to this exchange.
You would need to verify the claims yourself though.
CVE Details is a great site listing vulnerabilities narrowed down to manufacture, product and version.
In addition it also shows the published dates in any results, which is very useful.