There are always low-hanging fruit, though.

I remember pwning php-nuke sites with SQL injection more than a decade ago. At least as far as that dumpster fire (php nuke) goes there are 2021-dated CVEs for SQL injection so clearly at least some people aren't making headway.

I wonder if anyone publishes a broad survey of CVE categories akin to tfa.