system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
# -*- coding: utf-8 -*-
from django.db import models
from django.utils.encoding import python_2_unicode_compatible
from django.utils.translation import ugettext_lazy as _
import logging
from jinja2 import Environment
from permabots.models.base import PermabotsModel
from permabots import validators

logger = logging.getLogger(__name__)

@python_2_unicode_compatible    
class Response(PermabotsModel):
    """
    Model to generate a response to send in a message.
    """
    text_template = models.TextField(verbose_name=_("Text template"), validators=[validators.validate_template,
                                                                                  validators.validate_telegram_text_html],
                                     help_text=_("Template to generate text response. In jinja2 format. http://jinja.pocoo.org/"))
    keyboard_template = models.TextField(null=True, blank=True, verbose_name=_("Keyboard template"),
                                         validators=[validators.validate_template, validators.validate_telegram_keyboard],
                                         help_text=_("Template to generate keyboard response. In jinja2 format. http://jinja.pocoo.org/"))
    
    class Meta:
        verbose_name = _('Response')
        verbose_name_plural = _('Responses')

    def __str__(self):
        return "(text:%s, keyboard:%s)" % (self.text_template, self.keyboard_template)
    
    def process(self, **context):
        """
        Render response templates with context
        
        :param context: Context generated while processing a conversation handler or a notification hook
        :returns: Text and keyboard response
        """
        env = Environment(extensions=['jinja2_time.TimeExtension'])
        response_text_template = env.from_string(self.text_template)
        response_text = response_text_template.render(**context)
        logger.debug("Response %s generates text  %s" % (self.text_template, response_text))
        if self.keyboard_template:
            response_keyboard_template = env.from_string(self.keyboard_template)
            response_keyboard = response_keyboard_template.render(**context)
        else:
            response_keyboard = None
        logger.debug("Response %s generates keyboard  %s" % (self.keyboard_template, response_keyboard))
        return response_text, response_keyboard
```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  B) CWE-295: Improper Certificate Validation
  C) CWE-312: Cleartext Storage of Sensitive Information
  D) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  E) CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  F) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Answer: D