You don't necessarily need ORMs. If the developer had used prepared statements (e.g. PDO in php), then there would probably have been a lot less vulnerabilities.