IIRC, I think I analyzed and organized those pages in 2007. Looks like the big ones (XSS, injection) are still pretty much the same. In fact, looks like most of my work is pretty much the same, but some shiny new graphics have been added. :)

You'd be surprised at the number of pages I come across that still have these basic insecurities. Thankfully, automatic checking is making really basic CSRF attacks less prevalent.

I'm sure tptacek or someone more familiar with the current hotlist would have more to say, though.

Argh, didn't see that. Thanks.