As a core technology for vulnerability detection in Web applications, static application security testing (SAST) holds widespread industrial applications. However, existing static analysis tools face challenges in handling complex logical structures in modern Web applications, such as asynchronous request patterns and multi-source input semantics, due to limitations in the underlying design of taint analysis algorithms. To this end, this study proposes a multi-data flow static analysis method for security vulnerability detection in Web applications, which is aimed at extending the ability of traditional taint analysis algorithms in multiple dimensions to improve both detection performance and generalization. Vertically, the multi-stage data flow analysis is introduced to comprehensively consider the data dependency across different control flow paths via correlation and iterative algorithms, thereby effectively supporting the detection of deep vulnerabilities that require multiple asynchronous calls to be triggered. Horizontally, the multi-tag data flow analysis is introduced to distinguish different input sources via taint tags, thereby obtaining more detailed program context semantic information and enhancing vulnerability detection Precision related to complex semantics. Based on the above-mentioned method, a vulnerability detection prototype system named MultiFlow is developed for Java/JavaScript Web applications. Experimental evaluations demonstrate that MultiFlow’s multi-data flow analysis method features sound effectiveness on a dataset containing 60 real-world Web applications and third-party components, yielding Precision of 87.18%, 75.00%, and 83.72% respectively on complex Web vulnerability detection tasks including stored vulnerabilities, broken access control, and prototype pollution, with eight CVE IDs obtained. Compared with the existing methods, MultiFlow achieves higher Precision and Recall with less analysis overhead, thereby validating its practical significance.