Question: There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, who was the first to discover them **[Surely, it wasn't a single person]**, and when they were first discovered **[Surely, they weren't discovered at the same time]**, and so on.

Answer: 
You can 

* [search the CVE list](https://cve.mitre.org/cve/cve.html) for keywords or specific CVEs and
* [search the NVD of the NIST](https://web.nvd.nist.gov/view/vuln/search).

Those two links should be fine to answer questions you might have about individual vulnerabilities - not only constrained to web applications - although they do not usually disclose the actual person that found the vulnerability.
[CVE Details](http://www.cvedetails.com/) is a great site listing vulnerabilities narrowed down to manufacture, product and version.

In addition it also shows the published dates in any results, which is very useful.