What we discovered by scanning 235 OSS apps for security issues

That was terribly devoid of data and the only link in the article links back to their paid app. The choice in colors of the pie chart was just terrible.<p>Also, what do databases have to do with anything? Obviously MySQL would be heavily used since it's commonly used with PHP and other web frameworks.<p>Also, how is their scanner false positive free?

I don't understand how SQL injection still exists as a problem. Isn't it pretty much completely solved by using an ORM or prepared statements? Is it just laziness that allows it to fester on, or is there something I'm missing?

Sorry about the lack of disclosing the raw data, here is the document that infographic produced from:<p><a href="https://docs.google.com/a/mavitunasecurity.com/spreadsheet/ccc?key=0Ai3Dfx3aMZQ9dEJiemw0UE9TS0tUemdldVNTWG5MR2c" rel="nofollow">https://docs.google.com/a/mavitunasecurity.com/spreadsheet/c...</a><p>You can see the list of all scanned applications with versions and brief information about the results, including the advisory link (if published).<p>From advisory you can see technical details of the vulnerabilities, i.e. <a href="http://www.mavitunasecurity.com/xss-and-blind-sql-injection-vulnerabilities-in-exponentcms/" rel="nofollow">http://www.mavitunasecurity.com/xss-and-blind-sql-injection-...</a><p>List of all advisories from us (all found by Netsparker)<p><a href="http://www.mavitunasecurity.com/netsparker-advisories/" rel="nofollow">http://www.mavitunasecurity.com/netsparker-advisories/</a>

Your tinfoil hat should start buzzing when you see the word 'infographic.' Instead of data to backup the analysis, you should expect back links to a product or website (possibly far from the topic).<p>It is a well known art that infographics are highly popular on voting sites and a cheap way to build quality back links.

Not really on topic, but in that article, why would the paragraph "title" texts made up of images? (that appear to be in-page data).

Shame this isn't an unbiased/independent report.