system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
import re

from django.http import HttpResponse, HttpResponseBadRequest
from django.views.decorators.csrf import csrf_exempt
from django.conf import settings

import twilio.twiml

from backend.models import Property, Applicant

@csrf_exempt
def hello(request):
    r = twilio.twiml.Response()
    r.message("Hello from Apartment Alerts.")
    return HttpResponse(r)


def signup_handler(from_number, to_number, match):
    try:
        property = Property.objects.get(phone_number=to_number)
    except:
        return HttpResponseBadRequest("Unknown number '%s'." % to_number)

    property.applicants.create(
        phone_number=from_number,
        name=match.group('name'),
        bedrooms=int(match.group('rooms')),
        income=int(match.group('income').replace(',', ''))
    )

    response = twilio.twiml.Response()
    response.message(**{
        'to': from_number,
        'from': to_number,
        'msg': "Thank you %s. We will let you know when apartments open up." %
            match.group('name'),
    })

    return HttpResponse(response)


def alert_handler(from_number, to_number, match):
    try:
        property = Property.objects.get(phone_number=to_number)
    except:
        return HttpResponseBadRequest("Unknown number '%s'." % to_number)

    query = dict(
        bedrooms=int(match.group('rooms')),
        income__gte=int(match.group('income_min').replace(',', '')),
        income__lte=int(match.group('income_max').replace(',', ''))
    )

    message = "Unit opening at %s: %sCall %s." % (
        property.address,
        match.group('message') + ". ",
        property.contact_phone
    )

    response = twilio.twiml.Response()
    for applicant in property.applicants.filter(**query):
        print("sending to %s" % applicant.phone_number)
        response.message(**{
            'to': applicant.phone_number,
            'from': to_number,
            'msg': message
        })
    return HttpResponse(response)


SMS_ROUTES = [
    (re.compile(r'^signup (?P<name>[A-Za-z ]+), (?P<rooms>[0-9]) b[a-z]+ms?, \$?(?P<income>[0-9,]+)'),
     signup_handler),
    (re.compile(r'^alert (?P<rooms>[0-9]) b[a-z]+ms?, \$?(?P<income_min>[0-9,]+)-(?P<income_max>[0-9,]+). ?(?P<message>.*)$'),
     alert_handler)
]


@csrf_exempt
def inbound_route(request):
    try:
        if request.method == 'GET':
            params = request.GET
        else:
            params = request.POST

        to_number = params['To']
        from_number = params['From']
        body = params['Body']
    except:
        return HttpResponseBadRequest(
            "Expecting To, From and Body parameters.")

    for (regex, handler) in SMS_ROUTES:
        match = regex.match(body)
        if match:
            return handler(from_number, to_number, match)

    response = twilio.twiml.Response()
    response.message(**{
        'to': from_number,
        'from': to_number,
        'msg': "Couldn't parse message: '%s'" % body
    })

    return HttpResponse(response)

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  B) CWE-502: Deserialization of Untrusted Data
  C) CWE-732: Incorrect Permission Assignment for Critical Resource
  D) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  E) CWE-730: OWASP Top Ten 2004 Category A9 - Denial of Service
  F) CWE-312: Cleartext Storage of Sensitive Information
Answer: F