Question: Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.

Any suggestions on how they can be exploited please?

Answer: 
A legitimate website will rather not do that.

Then again, there are possibilities:

1. The site being compromised
2. The site being run by incompetent people (never underestimate...), collecting the data and get compromised in some future point.
3. The site collecting some data of failed logins in order to analyse and prevent brute-force or similar attacks. "Some data" probably includes login names and may or may not include passwords, parts of the passwords or hashes of the passwords and the hash may or may not be strong.
This would likely be recorded as an error on the website as it would return permission denied.
Many websites go through some kind of firewall or protection which might pick up failed attempted to try and block brute force log-in attempts or similar.

I would be pretty shocked to find that a (none compromised) website is storing passwords of failed log-in attempts, or any un-hashed/plaintext passwords at all.