system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
#!/usr/bin/env python3
#
# Copyright 2017 Peter Schmidt
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

import requests
import argparse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
# ------ START CONFIG --------------------------------------------------------

# Dictionary with username and a list of devices for each user.
devices = {'peter': ['android-abcdefgh', 'pta-x240l'],
           'astrid': ['android-123456789'],
           }

# Dictionary username and ISE of the system variable. Lookup the ISE (ise_id)
# here: http://homematic-ccu2/config/xmlapi/sysvarlist.cgi
presencevars = {'peter': 1903,
                'astrid': 1902,
                }

# Username and password for Unifi controller. No write access needed.
unifi_login = {'username': 'foo', 'password': 'bar'}

# Host:Port of UniFi controler
unifi = 'unifi:8443'

# Hostname of the Homematic CCU2
ccu2 = 'homematic-ccu2'

# ------ END CONFIG ---------------------------------------------------------
# Suppress SSL warning caused by the self signed certificate of the controller
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

parser = argparse.ArgumentParser()
parser.add_argument('-q', '--quiet', help="be quiet, shows only errors", action="store_true")
args = parser.parse_args()

isHere = []
req = requests.Session()

# Login to the controller
r = req.post("https://{0}/api/login".format(unifi), json=unifi_login, verify=False, headers={'referer': "https://{0}/login".format(unifi)})

if r.status_code == 200:
    # Get a list of all connected clients
    r = req.post("https://{0}/api/s/default/stat/sta/".format(unifi), verify=False, headers={'referer': "https://{0}/login".format(unifi)})
    if r.status_code == 200:
        json = r.json()
        for x in json['data']:
            for username, devicelist in devices.items():
                if x['hostname'] in devicelist:
                    isHere.append(username)

    for user, ise in presencevars.items():
        value = '1' if user in isHere else '0'
        if not args.quiet:
            print('{0} is {1}.'.format(user.title(), 'online' if user in isHere else 'offline'))

        url = 'http://{0}/config/xmlapi/statechange.cgi?ise_id={1}&new_value={2}'
        req.get(url.format(ccu2, ise, value))
else:
    print("Login to UniFi controller failed.")

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
  B) CWE-502: Deserialization of Untrusted Data
  C) CWE-326: Inadequate Encryption Strength
  D) CWE-327: Use of a Broken or Risky Cryptographic Algorithm
  E) CWE-295: Improper Certificate Validation
  F) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Answer: E