Quo vadis? A study of the evolution of input validation vulnerabilities in Web applications