system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import marshmallow
from flask import Blueprint, Response, current_app, request
from flask_login import login_required
from stefan_on_software import post_manager
from stefan_on_software.contracts.publish_post import PublishPostContract
from stefan_on_software.post_manager import NoSuchPost

# Blueprint under which all views will be assigned
BLUEPRINT = Blueprint("commands", __name__, url_prefix="/api/v1/commands")


@BLUEPRINT.route("/publish", methods=["POST"])
@login_required
def publish_post():
    try:
        contract = PublishPostContract.from_json(request.get_json())
    except marshmallow.exceptions.ValidationError as e:
        return Response(status=400, response="Invalid parameters: {}".format(e))

    try:
        post_manager.publish(
            contract.post_id, contract.send_email, contract.publish_date
        )
        return Response(status=204)
    except NoSuchPost:
        return Response(status=404)
    except Exception as e:
        current_app.logger.error(
            f"Unknown exception while publishing post with id={contract.post_id}: {e}"
        )
        return Response(status=500)


@BLUEPRINT.route("/unpublish", methods=["POST"])
@login_required
def unpublish_post():
    post_id = request.get_json().get("post_id")
    if not post_id:
        return Response(status=400, response="Missing post_id")
    try:
        post_manager.unpublish(post_id)
        return Response(status=204)
    except NoSuchPost:
        return Response(status=404)
    except Exception as e:
        current_app.logger.error(
            f"Unknown exception while un-publishing post with id={post_id}: {e}"
        )
        return Response(status=500)


@BLUEPRINT.route("/feature", methods=["POST"])
@login_required
def feature_post():
    post_id = request.get_json().get("post_id")
    if not post_id:
        return Response(status=400, response="Missing post_id")
    try:
        post_manager.set_featured(post_id, True)
        return Response(status=204)
    except NoSuchPost:
        return Response(status=404)
    except Exception as e:
        current_app.logger.error(
            f"Unknown exception while featuring post with id={post_id}: {e}"
        )
        return Response(status=500)


@BLUEPRINT.route("/unfeature", methods=["POST"])
@login_required
def unfeature_post():
    post_id = request.get_json().get("post_id")
    if not post_id:
        return Response(status=400, response="Missing post_id")
    try:
        post_manager.set_featured(post_id, False)
        return Response(status=204)
    except NoSuchPost:
        return Response(status=404)
    except Exception as e:
        current_app.logger.error(
            f"Unknown exception while featuring post with id={post_id}: {e}"
        )
        return Response(status=500)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
  B) CWE-1333: Inefficient Regular Expression Complexity
  C) CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  D) CWE-326: Inadequate Encryption Strength
  E) CWE-918: Server-Side Request Forgery (SSRF)
  F) CWE-209: Generation of Error Message Containing Sensitive Information
Answer: F