Question: There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, who was the first to discover them **[Surely, it wasn't a single person]**, and when they were first discovered **[Surely, they weren't discovered at the same time]**, and so on.

Answer: 
Wikipedia and Google would be my choice, as there isn't one authoritative website including the history of vulnerability types.

The usual places that list vulnerability types generally do not include a history section. For example, here is the [CWE on XSS](https://cwe.mitre.org/data/definitions/79.html), here is the [CAPEC on XSS](https://capec.mitre.org/data/definitions/63.html), and here is the [OWASP page on XSS](https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29). 

The CVE lists suggested by others list individual vulnerabilities (but not vulnerability classes). If you want to know who discovered specific vulnerabilities in specific applications they are a great place to look though.

Wikipedia on the other hand has a history or background section for most vulnerability types, eg on XSS:

> 
> Microsoft security-engineers introduced the term "cross-site scripting" in January 2000.  
> 
>  [...]  
> 
>  XSS vulnerabilities have been reported and exploited since the 1990s.
> 
> 
> 

Or on SQL Injection:

> 
> The first public discussions of SQL injection started appearing around 1998.[3] For example, a 1998 article in Phrack Magazine.[4]
> 
> 
> 

A google search for the history of CSRF would for example lead you to [this exchange](http://www.tux.org/~peterw/csrf.txt). 

You would need to verify the claims yourself though.
[CVE Details](http://www.cvedetails.com/) is a great site listing vulnerabilities narrowed down to manufacture, product and version.

In addition it also shows the published dates in any results, which is very useful.