Question: Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.

Any suggestions on how they can be exploited please?

Answer: 
A legitimate website will rather not do that.

Then again, there are possibilities:

1. The site being compromised
2. The site being run by incompetent people (never underestimate...), collecting the data and get compromised in some future point.
3. The site collecting some data of failed logins in order to analyse and prevent brute-force or similar attacks. "Some data" probably includes login names and may or may not include passwords, parts of the passwords or hashes of the passwords and the hash may or may not be strong.
In a previous job we logged failed credentials to a radius server used to authenticate internet connections. This was handy, we could reset customer's password to whatever their router was sending, or could see if the creds were from another ISP by the username.

My point is, there are times when logging failures is useful ("grandma you got caps-lock on again") However this was a decade ago, rules and regulations have moved on.

You are using a different password per service anyway right? So go to that one site, and change that one password that you think might have leaked. If its your default password for everything, then you have a lot more work to do.