WHID Top Ten Vulns and report http://projects.webappsec.org/Web-Hacking-Incident-Database-2010-Semi-Annual-Report