Title is wrong. Instead of saying that 16% of web vulns are XSS, it should say that 16% of the findings reported by this particular product/service are XSS.
Web vulnerability scanners can diff a lot in their results. Crawling algos/site coverage, finding and using different input vectors, specific testing methods &c are all very different across various products. Sectoolmarket is a good resource with results from WIVET (crawl tests more or less) and WAVSEP (detecting vulnerabilities). Even so, those benchmarks only cover a very small portion of possible web application attack vectors. And let's not forget the problem of crawling "The Deep Web" i.e., stateful web applications.
Comments
Title is wrong. Instead of saying that 16% of web vulns are XSS, it should say that 16% of the findings reported by this particular product/service are XSS.
Web vulnerability scanners can diff a lot in their results. Crawling algos/site coverage, finding and using different input vectors, specific testing methods &c are all very different across various products. Sectoolmarket is a good resource with results from WIVET (crawl tests more or less) and WAVSEP (detecting vulnerabilities). Even so, those benchmarks only cover a very small portion of possible web application attack vectors. And let's not forget the problem of crawling "The Deep Web" i.e., stateful web applications.
TL;DR: title is wrong.