Question: Which is harder to exploit:
Password reset link with tokens/timestamps/code/ticket etc
Or, temporary password sent on user mail using which login can be done and password can be changed.

Any suggestions on how they can be exploited please?

Answer: 
I think the general answer here is that ***passwords*** are not normally logged by any legitimate service. Usernames certainly are. 

To record passwords is a problem, even for the "correct" site. Services should not know what your passwords are, which is why there are some complicated processes used to store passwords. I have seen some very poorly designed systems where passwords are recorded, but this is an error/incompetence in design.

Malicious websites, on the other hand, do record your username and passwords, because they want to know them and abuse them.
Ignoring deliberately malicious websites, it can happen by accident or neglect. I refer you to Twitter: <https://www.theverge.com/2018/5/3/17316684/twitter-password-bug-security-flaw-exposed-change-now>

> 
> May 3, 2018
> 
> 
> According to Twitter, the bug occurred due to an issue in the hashing process that masks passwords by replacing them with a random string of characters that get stored on Twitter’s system. But due to an error with the system, apparently passwords were being saved in plain text to an internal log, instead of masking them with the hashing process. Twitter claims to have found the bug on its own and removed the passwords. It’s working to make sure that similar issues don’t come up again.
> 
> 
>