The application accepts script tags which can act as a backdoor scripting vulnerability for the server. For example, for you save a to-do as follows:

<script>alert("Hello")</script>

it shows up in the host server on saving.