system: You are an expert security code reviewer. You will be shown a source code file along with a multi-select question listing several CWE (Common Weakness Enumeration) categories. Your task is to identify which of the listed CWEs are present in the code.

OUTPUT FORMAT: Respond with the letter(s) of all correct options, sorted alphabetically and comma-separated, wrapped in a single \boxed{...}. Examples: `\boxed{A}` for one correct, `\boxed{A,C}` for two, `\boxed{A,C,E}` for three. Output the boxed answer ONLY -- no explanation, no other text.

user: ```python
""" Define the endpoints for searching. """

import datetime
import json
import typing

import fastapi
import requests
from starlette import responses, status

import config
import schemas.financing_statement
import schemas.search
import repository.search_repository

router = fastapi.APIRouter()


# TODO: read the ims-api endpoint from an environment variable.
@router.get('/search')
async def search(serial: str, response: responses.Response):
    """
    Find financial statements that match the search criteria.

        Parameters:
            serial: The serial number to search for.
    """
    ims_response = requests.get(config.IMS_API_URL + '/search?serial={}'.format(serial))

    response.status_code = ims_response.status_code

    return json.loads(ims_response.content.decode('utf-8'))


@router.get('/searches/{search_id}', response_model=schemas.search.Search, response_model_by_alias=False)
def read_search(search_id: int, search_repository: repository.search_repository.SearchRepository = fastapi.Depends()):
    """
    Get the details for a previously submitted search request

        Parameters:
            search_id: The identifier of the search instance to lookup
        Returns:
            schemas.search.Search
    """
    search_db_row = search_repository.get_search(search_id)
    if search_db_row is None:
        raise fastapi.HTTPException(status_code=404, detail='Search record not found')
    return search_db_row


@router.post('/searches', response_model=schemas.search.Search, response_model_by_alias=False)
def create_search(response: responses.Response, search_input: schemas.search.SearchBase,
                  search_repository: repository.search_repository.SearchRepository = fastapi.Depends()):
    exact_matches = []
    similar_matches = []
    # TODO execute the search query and create search_result records. See https://github.com/bcgov/ppr/issues/222
    # The financing statements are not yet available to search, so create an exact match for now
    if search_input.type == schemas.search.SearchType.REGISTRATION_NUMBER.value:
        exact_matches = [search_input.criteria['value']]

    search_model = search_repository.create_search(search_input, exact_matches, similar_matches)
    response.status_code = status.HTTP_201_CREATED
    return search_model


@router.get('/searches/{search_id}/results', response_model=typing.List[schemas.search.SearchResult],
            response_model_by_alias=False)
def read_search_results(search_id: int,
                        search_repository: repository.search_repository.SearchRepository = fastapi.Depends()):
    """
    List the results for the provided search

        Parameters:
            search_id: The identifier of the search instance to lookup
        Returns:
            typing.List[schemas.search.SearchResult]
    """
    # TODO Showing dummy data for the moment, complete as the data model fills out. Issue #222.
    fin_stmt = schemas.financing_statement.FinancingStatement(
        baseRegistrationNumber='123456A', documentId='B9876543', registrationDateTime=datetime.datetime.now(),
        type='SECURITY_AGREEMENT', registeringParty={}, securedParties=[], debtors=[], vehicleCollateral=[],
        generalCollateral=[], expiryDate=datetime.date.today()
    )
    return [schemas.search.SearchResult(type='EXACT', financingStatement=fin_stmt)]

```

Which of the following CWE vulnerability categories are present in this code? Multiple options may be correct.

  A) CWE-326: Inadequate Encryption Strength
  B) CWE-918: Server-Side Request Forgery (SSRF)
  C) CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
  D) CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
  E) CWE-117: Improper Output Neutralization for Logs
  F) CWE-295: Improper Certificate Validation
Answer: B