A "suspected attack" has left 28 injured, including children, following a car driving into a crowd of people.