What’s Vulnerable › Vulnerabilities

CVE-2026-9493: BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-29 · updated 2026-07-21
• Weakness: CWE-639

Description

Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify the parameter of a specific query function to access other users' EC order details.

Affected products

• BankPro E-Service Technology Service Center: 0

References

• https://www.twcert.org.tw/en/cp-139-10940-d90bd-2.html
• https://www.twcert.org.tw/tw/cp-132-10938-97ddd-1.html

Get alerted when CVE-2026-9493 or the next vulnerability affects your stack