CE 10
Include(RFI/LFI) 9/8
SQL-injection(normal/blind/fragment) 7/6/7
Path Traversal 6
bypass(в форме авторизации/logical flaws) 4/5
XSS(passive/active) 3/5.5
CSRF 1
Information leaking 0.1