XSS (cross-site scripting) replaced buffer overflows as the most common vulnerability in 2005.

source: http://maxedv.com/wp-content/uploads/2011/12/Sourcefire-25-Y...