system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
from flask import Flask, request, render_template, redirect
from datetime import datetime
from models import db, Student

app = Flask(__name__)
app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///students2.db'
app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
db.init_app(app)


@app.before_first_request
def create_table():
    db.create_all()


@app.route('/')
def home():
    return "Welcome to simple student repository!"


@app.route('/student/create', methods=['GET', 'POST'])
def create():
    if request.method == 'GET':
        return render_template('create.html')

    if request.method == 'POST':
        student_id = request.form['student_id']
        first_name = request.form['first_name']
        last_name = request.form['last_name']

        y, m, d = request.form['dob'].split('-')
        dob = datetime(int(y), int(m), int(d))

        amount_due = request.form['amount_due']

        student = Student(student_id=student_id, first_name=first_name, last_name=last_name,
                          dob=dob, amount_due=amount_due)

        db.session.add(student)
        db.session.commit()

        return redirect('/student/all')


@app.route('/student/all')
def get_all_students():
    students = Student.query.all()
    return render_template('view_all.html', students=students)


@app.route('/student/<int:std_id>')
def get_student_by_id(std_id):
    student = Student.query.filter_by(student_id=std_id).first()

    if student:
        return render_template('view.html', student=student)

    return f"Student with id = {std_id} doesn't exist."


@app.route('/student/update/<int:std_id>', methods=['GET', 'POST'])
def update(std_id):
    if request.method == 'GET':
        student = Student.query.filter_by(student_id=std_id).first()

        if student:
            return render_template('update.html', student=student)

        return f"Student with id = {std_id} doesn't exist."

    if request.method == 'POST':
        student = Student.query.filter_by(student_id=std_id).first()

        if student:
            student.first_name = request.form['first_name']
            student.last_name = request.form['last_name']

            y, m, d = request.form['dob'].split('-')
            student.dob = datetime(int(y), int(m), int(d))

            student.amount_due = request.form['amount_due']

            db.session.commit()

    return redirect('/student/all')


@app.route('/student/delete/<int:std_id>')
def delete(std_id):
    student = Student.query.filter_by(student_id=std_id).first()

    if student:
        db.session.delete(student)
        db.session.commit()
        return redirect('/student/all')
    else:
        return f"Student with id = {std_id} doesn't exist."


if __name__ == '__main__':
    app.run(host='localhost', port=5000)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  B) CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
  C) CWE-502: Deserialization of Untrusted Data
  D) CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  E) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  F) CWE-215: Insertion of Sensitive Information Into Debugging Code
Answer: E