Question: There are many web application vulnerabilities out there, such as XSS, CSRF, and etc, and there are many resources which explain them very well. But I want to find about their history, for example, who was the first to discover them **[Surely, it wasn't a single person]**, and when they were first discovered **[Surely, they weren't discovered at the same time]**, and so on.

Answer: 
You can 

* [search the CVE list](https://cve.mitre.org/cve/cve.html) for keywords or specific CVEs and
* [search the NVD of the NIST](https://web.nvd.nist.gov/view/vuln/search).

Those two links should be fine to answer questions you might have about individual vulnerabilities - not only constrained to web applications - although they do not usually disclose the actual person that found the vulnerability.
Wikipedia and Google would be my choice, as there isn't one authoritative website including the history of vulnerability types.

The usual places that list vulnerability types generally do not include a history section. For example, here is the [CWE on XSS](https://cwe.mitre.org/data/definitions/79.html), here is the [CAPEC on XSS](https://capec.mitre.org/data/definitions/63.html), and here is the [OWASP page on XSS](https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29). 

The CVE lists suggested by others list individual vulnerabilities (but not vulnerability classes). If you want to know who discovered specific vulnerabilities in specific applications they are a great place to look though.

Wikipedia on the other hand has a history or background section for most vulnerability types, eg on XSS:

> 
> Microsoft security-engineers introduced the term "cross-site scripting" in January 2000.  
> 
>  [...]  
> 
>  XSS vulnerabilities have been reported and exploited since the 1990s.
> 
> 
> 

Or on SQL Injection:

> 
> The first public discussions of SQL injection started appearing around 1998.[3] For example, a 1998 article in Phrack Magazine.[4]
> 
> 
> 

A google search for the history of CSRF would for example lead you to [this exchange](http://www.tux.org/~peterw/csrf.txt). 

You would need to verify the claims yourself though.