diff --git a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
index 2e888bf80df5..f9153b95700e 100644
--- a/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
+++ b/cpp/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
@@ -34,7 +34,7 @@ should be safe against command injection.</p>
 Sanitize data passed to complex subsystems</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 
diff --git a/cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.qhelp b/cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.qhelp
index 6dd9662c57d5..eb13e3785542 100644
--- a/cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.qhelp
+++ b/cpp/ql/src/experimental/Security/CWE/CWE-078/WordexpTainted.qhelp
@@ -31,7 +31,7 @@ is performed, making this safe from command injection.</p>
 Sanitize data passed to complex subsystems</a>.</li>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 
diff --git a/csharp/ql/src/Security Features/CWE-078/CommandInjection.qhelp b/csharp/ql/src/Security Features/CWE-078/CommandInjection.qhelp
index ce5fec7c571a..af8855095325 100644
--- a/csharp/ql/src/Security Features/CWE-078/CommandInjection.qhelp	
+++ b/csharp/ql/src/Security Features/CWE-078/CommandInjection.qhelp	
@@ -33,7 +33,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 <!--  LocalWords:  CWE untrusted unsanitized Runtime
diff --git a/go/ql/src/Security/CWE-078/CommandInjection.qhelp b/go/ql/src/Security/CWE-078/CommandInjection.qhelp
index 1623268c5675..b59730db0cf1 100644
--- a/go/ql/src/Security/CWE-078/CommandInjection.qhelp
+++ b/go/ql/src/Security/CWE-078/CommandInjection.qhelp
@@ -58,7 +58,7 @@ not interpreted as flags, or verify that the argument does not start with <code>
 </example>
 <references>
 <li>
-OWASP: <a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+OWASP: <a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 </references>
 </qhelp>
diff --git a/go/ql/src/Security/CWE-078/StoredCommand.qhelp b/go/ql/src/Security/CWE-078/StoredCommand.qhelp
index 48800c753ce5..43317ab77b3b 100644
--- a/go/ql/src/Security/CWE-078/StoredCommand.qhelp
+++ b/go/ql/src/Security/CWE-078/StoredCommand.qhelp
@@ -39,7 +39,7 @@ ensure that commands are checked against a whitelist:
 
 <references>
 <li>
-OWASP: <a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+OWASP: <a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 </references>
 </qhelp>
diff --git a/go/ql/src/Security/CWE-089/StringBreak.qhelp b/go/ql/src/Security/CWE-089/StringBreak.qhelp
index 399eb8170e41..46ef8a6c0941 100644
--- a/go/ql/src/Security/CWE-089/StringBreak.qhelp
+++ b/go/ql/src/Security/CWE-089/StringBreak.qhelp
@@ -67,6 +67,6 @@ that it has two limitations:
 
 <references>
 <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/SQL_injection">SQL injection</a>.</li>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.</li>
+<li>OWASP: <a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.</li>
 </references>
 </qhelp>
diff --git a/java/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp b/java/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
index a8b7508763cb..046b7790bb40 100644
--- a/java/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
+++ b/java/ql/src/Security/CWE/CWE-078/ExecTainted.qhelp
@@ -33,7 +33,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 <li>SEI CERT Oracle Coding Standard for Java:
   <a href="https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec()+method">IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method</a>.</li>
diff --git a/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.qhelp b/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.qhelp
index 4520828b1be2..d6f551a656e9 100644
--- a/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.qhelp
+++ b/java/ql/src/Security/CWE/CWE-078/ExecUnescaped.qhelp
@@ -34,7 +34,7 @@ an argument.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 <li>SEI CERT Oracle Coding Standard for Java:
   <a href="https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec()+method">IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method</a>.</li>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.qhelp b/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.qhelp
index 820f5b71405f..d91db89704b3 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExec.qhelp
@@ -32,7 +32,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 <li>SEI CERT Oracle Coding Standard for Java:
   <a href="https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec()+method">IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method</a>.</li>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExecLocal.qhelp b/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExecLocal.qhelp
index be2b7aac973b..b7867b9603bb 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExecLocal.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-078/CommandInjectionRuntimeExecLocal.qhelp
@@ -32,7 +32,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 <li>SEI CERT Oracle Coding Standard for Java:
   <a href="https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec()+method">IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method</a>.</li>
diff --git a/java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.qhelp b/java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.qhelp
index a8b7508763cb..046b7790bb40 100644
--- a/java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.qhelp
+++ b/java/ql/src/experimental/Security/CWE/CWE-078/ExecTainted.qhelp
@@ -33,7 +33,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 <li>SEI CERT Oracle Coding Standard for Java:
   <a href="https://wiki.sei.cmu.edu/confluence/display/java/IDS07-J.+Sanitize+untrusted+data+passed+to+the+Runtime.exec()+method">IDS07-J. Sanitize untrusted data passed to the Runtime.exec() method</a>.</li>
diff --git a/javascript/ql/src/Security/CWE-078/CommandInjection.inc.qhelp b/javascript/ql/src/Security/CWE-078/CommandInjection.inc.qhelp
index 5e598d235950..063c7ac34649 100644
--- a/javascript/ql/src/Security/CWE-078/CommandInjection.inc.qhelp
+++ b/javascript/ql/src/Security/CWE-078/CommandInjection.inc.qhelp
@@ -53,7 +53,7 @@ against an allowlist of safe characters before using it:</p>
 <references>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 <li>
 npm:
diff --git a/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp b/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp
index 83ddaef0814f..ec81d76761da 100644
--- a/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp
+++ b/javascript/ql/src/Security/CWE-078/IndirectCommandInjection.qhelp
@@ -106,7 +106,7 @@ into an array of arguments instead.
 
 		<li>
 			OWASP:
-			<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+			<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 		</li>
 
 		<li>
diff --git a/javascript/ql/src/Security/CWE-078/SecondOrderCommandInjection.qhelp b/javascript/ql/src/Security/CWE-078/SecondOrderCommandInjection.qhelp
index d85b4c232889..4c377cb913cd 100644
--- a/javascript/ql/src/Security/CWE-078/SecondOrderCommandInjection.qhelp
+++ b/javascript/ql/src/Security/CWE-078/SecondOrderCommandInjection.qhelp
@@ -40,7 +40,7 @@ being passed to the shell command.
 <references>
 <li>Max Justicz: <a href="https://justi.cz/security/2021/04/20/cocoapods-rce.html">Hacking 3,000,000 apps at once through CocoaPods</a>.</li>
 <li>Git: <a href="https://git-scm.com/docs/git-ls-remote/2.22.0#Documentation/git-ls-remote.txt---upload-packltexecgt">Git - git-ls-remote Documentation</a>.</li>
-<li>OWASP: <a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.</li>
+<li>OWASP: <a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.</li>
 
 </references>
 </qhelp>
diff --git a/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.qhelp b/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.qhelp
index 8937b67a420a..e5d3660639b0 100644
--- a/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.qhelp
+++ b/javascript/ql/src/Security/CWE-078/ShellCommandInjectionFromEnvironment.qhelp
@@ -96,7 +96,7 @@
 
 	<li>
 		OWASP:
-		<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+		<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 	</li>
 
 </references>
diff --git a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp
index e2829cf85e01..d35b0f34721d 100644
--- a/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp
+++ b/javascript/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp
@@ -102,7 +102,7 @@
 
 	<li>
 		OWASP:
-		<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+		<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 	</li>
 
 	<li>
diff --git a/javascript/ql/src/Security/CWE-078/UselessUseOfCat.qhelp b/javascript/ql/src/Security/CWE-078/UselessUseOfCat.qhelp
index 5ef218bdf59b..72780659f83a 100644
--- a/javascript/ql/src/Security/CWE-078/UselessUseOfCat.qhelp
+++ b/javascript/ql/src/Security/CWE-078/UselessUseOfCat.qhelp
@@ -36,7 +36,7 @@ and if the input is user-controlled, a command injection attack can happen.</p>
 </example>
 <references>
 
-<li>OWASP: <a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.</li>
+<li>OWASP: <a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.</li>
 <li>Node.js: <a href="https://nodejs.org/api/fs.html">File System API</a>.</li>
 <li><a href="http://porkmail.org/era/unix/award.html#cat">The Useless Use of Cat Award</a>.</li>
 
diff --git a/python/ql/src/Security/CWE-078/CommandInjection.qhelp b/python/ql/src/Security/CWE-078/CommandInjection.qhelp
index 62539a60ceb3..f5e8061788b9 100644
--- a/python/ql/src/Security/CWE-078/CommandInjection.qhelp
+++ b/python/ql/src/Security/CWE-078/CommandInjection.qhelp
@@ -34,7 +34,7 @@ The second is safe as it selects the command from a predefined allowlist.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 </references>
diff --git a/python/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp b/python/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp
index 007e691c2433..6efecf63c4ad 100644
--- a/python/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp
+++ b/python/ql/src/Security/CWE-078/UnsafeShellCommandConstruction.qhelp
@@ -66,7 +66,7 @@
 
 	<li>
 		OWASP:
-		<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+		<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 	</li>
 
 </references>
diff --git a/ruby/ql/src/queries/security/cwe-078/CommandInjection.qhelp b/ruby/ql/src/queries/security/cwe-078/CommandInjection.qhelp
index d01465d1dae5..19389bf6fe31 100644
--- a/ruby/ql/src/queries/security/cwe-078/CommandInjection.qhelp
+++ b/ruby/ql/src/queries/security/cwe-078/CommandInjection.qhelp
@@ -34,7 +34,7 @@ without examining it first.</p>
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 
 <!--  LocalWords:  CWE untrusted unsanitized Runtime
diff --git a/ruby/ql/src/queries/security/cwe-078/KernelOpen.inc.qhelp b/ruby/ql/src/queries/security/cwe-078/KernelOpen.inc.qhelp
index 2c220ba7aea1..10dbe15ebe64 100644
--- a/ruby/ql/src/queries/security/cwe-078/KernelOpen.inc.qhelp
+++ b/ruby/ql/src/queries/security/cwe-078/KernelOpen.inc.qhelp
@@ -39,7 +39,7 @@ user-supplied file path.
 
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 <a href="https://cheatsheetseries.owasp.org/cheatsheets/Ruby_on_Rails_Cheat_Sheet.html#command-injection">Ruby on Rails Cheat Sheet: Command Injection</a>.
 </li>
 
diff --git a/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp b/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp
index 8cedb57c277c..18c2380019b5 100644
--- a/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp
+++ b/ruby/ql/src/queries/security/cwe-078/UnsafeShellCommandConstruction.qhelp
@@ -71,7 +71,7 @@
 
 	<li>
 		OWASP:
-		<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+		<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 	</li>
 
 </references>
diff --git a/swift/ql/src/queries/Security/CWE-078/CommandInjection.qhelp b/swift/ql/src/queries/Security/CWE-078/CommandInjection.qhelp
index ed6a27a4222b..9fb39fd64a32 100644
--- a/swift/ql/src/queries/Security/CWE-078/CommandInjection.qhelp
+++ b/swift/ql/src/queries/Security/CWE-078/CommandInjection.qhelp
@@ -39,7 +39,7 @@ meanings:
 <references>
 <li>
 OWASP:
-<a href="https://www.owasp.org/index.php/Command_Injection">Command Injection</a>.
+<a href="https://community.owasp.org/attacks/Command_Injection">Command Injection</a>.
 </li>
 </references>
 </qhelp>