Web application vulnerabilities remains the primary avenue of attack for cybercriminals, according to a new report.