# Exploits in scan reports

> Reading the Exploit column in scan reports: which reported CVEs have a known exploit.

Source: https://scansuite.eu/documentation/usage/working-with-scan-results/checking-for-exploitable-vulnerabilities
Last reviewed: 2026-10-19

The spreadsheets in a scan's report say, for each CVE they list, whether it has an exploit. The evidence comes from the [Exploitable Vulnerabilities Database](https://scansuite.eu/documentation/usage/vulnerability-database), which is shipped with ScanSuite and searched locally. This page is about reading it in the reports.

## Which reports carry it

| Scanner | Scan page | Where in the archive |
|---|---|---|
| Trivy, the dependency check | Static Code Analysis | trivy-dep-report.xlsx |
| Nessus | Infrastructure Checks | The Nessus report folder |
| OpenVAS | Infrastructure Checks | The OpenVAS report folder |
| Nuclei | Infrastructure Checks | The Nuclei report folder |
| Local Patching Checks | Infrastructure Checks | Its report folder |

## Read the Exploit column

1. Download the scan's report: **Report** on its row in [Scan History](https://scansuite.eu/documentation/usage/managing-scan-execution), or **Download report** on the scan's page.

   *Check:* a ZIP archive downloads.
2. Open the archive and the XLSX file of the scanner, for example `trivy-dep-report.xlsx`, or the scanner's folder.
3. Read the **Exploit** column: **Yes** when the database holds exploitation evidence for the CVE, **No** when it holds none.

![Report archive contents](https://scansuite.eu/static/assets/img/docs/usage/working-with-scan-results/checking-for-exploitable-vulnerabilities/04.png)

*The XLSX reports inside the archive*

![Scanner report folder](https://scansuite.eu/static/assets/img/docs/usage/working-with-scan-results/checking-for-exploitable-vulnerabilities/05.png)

*A scanner report folder*

![Enriched report exploit column](https://scansuite.eu/static/assets/img/docs/usage/working-with-scan-results/checking-for-exploitable-vulnerabilities/06.png)

*The Exploit column in an enriched report*

## What to do with it

- Fix the CVEs with an exploit first. For details of one — the evidence level, the exploit references, the affected versions — search it in [Vuln DB](https://scansuite.eu/documentation/usage/vulnerability-database).
- For code dependencies, [Dependency reachability](https://scansuite.eu/documentation/usage/static-code-analysis/dependency-reachability) goes further: it checks whether your code reaches the vulnerable function of each dependency CVE that has exploitation evidence.