CVE-2026-9493

MEDIUM

BankPro E-Service Technology｜Service Center - Insecure Direct Object Reference

Title source: cna
STIX 2.1

Description

Service Center developed by BankPro E-Service Technology has an Insecure Direct Object Reference vulnerability, allowing authenticated remote attackers to modify the parameter of a specific query function to access other users' EC order details.

References (2)

Core 2
Core References
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/tw/cp-132-10938-97ddd-1.html
Third Party Advisory third-party-advisory
https://www.twcert.org.tw/en/cp-139-10940-d90bd-2.html

Scores

CVSS v3 6.5
EPSS 0.0026
EPSS Percentile 17.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
BankPro E-Service Technology/Service Center
Published May 29, 2026
Tracked Since May 29, 2026