Question: Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.

Any suggestions on how they can be exploited please?

Answer: 
This would likely be recorded as an error on the website as it would return permission denied.
Many websites go through some kind of firewall or protection which might pick up failed attempted to try and block brute force log-in attempts or similar.

I would be pretty shocked to find that a (none compromised) website is storing passwords of failed log-in attempts, or any un-hashed/plaintext passwords at all.
Ignoring deliberately malicious websites, it can happen by accident or neglect. I refer you to Twitter: <https://www.theverge.com/2018/5/3/17316684/twitter-password-bug-security-flaw-exposed-change-now>

> 
> May 3, 2018
> 
> 
> According to Twitter, the bug occurred due to an issue in the hashing process that masks passwords by replacing them with a random string of characters that get stored on Twitter’s system. But due to an error with the system, apparently passwords were being saved in plain text to an internal log, instead of masking them with the hashing process. Twitter claims to have found the bug on its own and removed the passwords. It’s working to make sure that similar issues don’t come up again.
> 
> 
>