Question: Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.

Any suggestions on how they can be exploited please?

Answer: 
I think the general answer here is that ***passwords*** are not normally logged by any legitimate service. Usernames certainly are. 

To record passwords is a problem, even for the "correct" site. Services should not know what your passwords are, which is why there are some complicated processes used to store passwords. I have seen some very poorly designed systems where passwords are recorded, but this is an error/incompetence in design.

Malicious websites, on the other hand, do record your username and passwords, because they want to know them and abuse them.
They should not, but good security practice would be to consider the password used as compromised and change it.

After all, if you lose a set of keys for your home, wouldn't make you less worried to replace the locks?