Injected content is text, links, or code added to a legitimate webpage without authorization. It may be placed in a page’s files or database, or introduced through a compromised content-management system, vulnerable plugin, stolen account, or other weakness.
Attackers may use injected content to publish spam pages, hide links, redirect visitors, or manipulate search results. It can damage a trusted site’s reputation and expose visitors to unwanted material. Defenders should verify reported URLs, preserve logs, and inspect recent file, database, publishing, and account changes. Unexpected content is a reason to investigate, but it does not alone establish how a site was altered or prove a specific intrusion.