CVE-2025-28198: Hitstiresoftware Hitout Car Sale

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController.java component.

Affected products

• Hitstiresoftware Hitout Car Sale: version 1.0 only

Published 2025-04-15. Last modified 2026-06-17.