Twitter‑Clone 1 contains an unauthenticated SQL injection flaw in the search.php endpoint, where the name parameter is passed directly to a database query. By injecting crafted payloads, an attacker can execute arbitrary SQL statements, retrieve usernames, credentials, and other system data, and exploit the flaw using both error‑based and union‑based techniques.

The open‑source Twitter‑Clone 1 application released by Fyffe on GitHub is affected. Any deployment that has not migrated to a version that properly sanitizes or parameterizes the name input is vulnerable; no specific version range is provided in the advisory.

The CVSS score of 8.8 indicates a high severity vulnerability that allows attackers to extract sensitive data without authentication. The exploit requires only web access to the application and is publicly demonstrated in exploit‑db. Though no EPSS score or KEV listing is available, the readily available proof‑of‑concept and the lack of defensive measures suggest a significant risk of data compromise.