A 500 server error might hint that you did something the developers weren't expecting, but it does not mean that there is a vulnerability. Maybe it just outputs a "hacking attempt averted" message in the log and gives you a nondescript error to not give you any useful information.
When you are convinced the software is unsafe, you could spread some FUD online about the software and the banks using them, but any reaction you will trigger would be a cease&desist letter for slandering. Unless you have a working exploit which proves that there is a vulnerability, nobody has a reason to believe that you really found one.
But trying to find and use such an exploit on a production system you do not own can be a criminal act in many parts of the world and can bring you into serious legal problems. When you want to do penetration-testing on a software, you need to set up your own, private instance. When the software is not freely available, this can be quite difficult to do.
Informing the developers that you might have found a bug in their software is really all you can do. When they believe that the bug is not exploitable and unlikely to be triggered by a normal user and thus not worth fixing, that's their decision.