CVE-2023-49980 is a high severity (CVSS 7.5) directory listing flaw in Best Student Result Management System 1.0. Anyone can list folders and sensitive files without logging in. No fixed version is named, so turn off directory listing or remove the application.
What's affected
The record names Best Student Result Management System 1.0 from mayurik, distributed on SourceCodester. The weakness is CWE-862 (missing authorization). The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
The description says attackers can list directories and sensitive files within the application without authorization. Fixed versions: none named in the sources I read. The references are a researcher page and the SourceCodester project page, neither of which names a fix.
A school or training site running this software holds student names, grades and login data, so a listing can expose personal information.
How to check if you're exposed
Find out whether you run this application. It is a downloadable sample project, often used for learning or small internal tools, so it may sit on a forgotten server.
grep -ril "sourcecodester" /var/www 2>/dev/null | head
On Apache, look for Options Indexes in the site configuration. On nginx, look for autoindex on. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan checks the open source packages in a manifest against known CVEs. It only sees what you give it, so it will not find a firmware image or a hosted product on its own. Use it for the code you ship and your asset list for everything else.
What to do now
- Find every copy of the application and decide whether it is still needed.
- If it is not needed, remove it. A sample project is rarely worth keeping online.
- If it must stay, put it behind a login at the web server and restrict it to trusted networks.
- Turn off directory listing in the web server and block access to upload, backup and configuration folders.
- Review the data the application holds and treat anything exposed as readable by others.
- Do not reuse passwords from this application anywhere else.
Why it matters
Directory listing is a web server setting, not only an application bug. When the server returns a file index for a folder with no index page, everything inside is visible.
Because student data is involved, privacy rules may apply to the people who run the site. This CVE is not on the CISA KEV list.
Quick check
Is there a vendor patch?
None is named in the sources I read.
What is the quickest mitigation?
Turn off directory listing in the web server and restrict the application to trusted networks.
Sources
Last reviewed: 19 October 2026.
